--- /dev/null
+From stable+bounces-268568-greg=kroah.com@vger.kernel.org Thu Jun 25 16:15:17 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 10:08:46 -0400
+Subject: crypto: qat - remove unused character device and IOCTLs
+To: stable@vger.kernel.org
+Cc: Giovanni Cabiddu <giovanni.cabiddu@intel.com>, Zhi Wang <wangzhi@stu.xidian.edu.cn>, Bin Yu <byu@xidian.edu.cn>, MingYu Wang <w15303746062@163.com>, Ahsan Atta <ahsan.atta@intel.com>, Herbert Xu <herbert@gondor.apana.org.au>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625140846.2431963-5-sashal@kernel.org>
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit d237230728c567297f2f98b425d63156ab2ed17f ]
+
+The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
+for device configuration, start, stop, status query and enumeration.
+These IOCTLs are not part of any public uAPI header and have no known
+in-tree or out-of-tree users. Device lifecycle is already managed via
+sysfs.
+
+The ioctl interface also increases the attack surface and is the
+subject of a number of bug reports.
+
+Remove the character device, the IOCTL definitions, and the related
+data structures (adf_dev_status_info, adf_user_cfg_key_val,
+adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
+adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
+module_init/module_exit hooks for workqueue, AER, and crypto/compression
+algorithm registration.
+
+Clean up leftover dead code that was only reachable from the removed
+IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
+adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
+adf_get_vf_real_id() and the unused ADF_CFG macros.
+
+Additionally, drop the entry associated to QAT IOCTLs in
+ioctl-number.rst.
+
+Cc: stable@vger.kernel.org
+Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework")
+Reported-by: Zhi Wang <wangzhi@stu.xidian.edu.cn>
+Reported-by: Bin Yu <byu@xidian.edu.cn>
+Reported-by: MingYu Wang <w15303746062@163.com>
+Closes: https://lore.kernel.org/all/61d6d499.ab89.19b9b7f3186.Coremail.wangzhi_xd@stu.xidian.edu.cn/
+Link: https://lore.kernel.org/all/20260508034841.256794-1-w15303746062@163.com/
+Link: https://lore.kernel.org/all/20260508023542.256299-1-w15303746062@163.com/
+Link: https://lore.kernel.org/all/20260504025120.98242-1-w15303746062@163.com/
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/userspace-api/ioctl/ioctl-number.rst | 1
+ drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10
+ drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1
+ drivers/crypto/intel/qat/qat_common/adf_cfg_common.h | 32 -
+ drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 -
+ drivers/crypto/intel/qat/qat_common/adf_common_drv.h | 3
+ drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 -------------------
+ drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ---
+ 8 files changed, 1 insertion(+), 558 deletions(-)
+ delete mode 100644 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h
+
+--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
+@@ -225,7 +225,6 @@ Code Seq# Include File
+ <mailto:gregkh@linuxfoundation.org>
+ 'a' all linux/atm*.h, linux/sonet.h ATM on linux
+ <http://lrcwww.epfl.ch/>
+-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver
+ 'b' 00-FF conflict! bit3 vme host bridge
+ <mailto:natalia@nikhefk.nikhef.nl>
+ 'b' 00-0F linux/dma-buf.h conflict!
+--- a/drivers/crypto/intel/qat/qat_common/adf_cfg.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.c
+@@ -103,16 +103,6 @@ static void adf_cfg_section_del_all(stru
+ static void adf_cfg_section_del_all_except(struct list_head *head,
+ const char *section_name);
+
+-void adf_cfg_del_all(struct adf_accel_dev *accel_dev)
+-{
+- struct adf_cfg_device_data *dev_cfg_data = accel_dev->cfg;
+-
+- down_write(&dev_cfg_data->lock);
+- adf_cfg_section_del_all(&dev_cfg_data->sec_list);
+- up_write(&dev_cfg_data->lock);
+- clear_bit(ADF_STATUS_CONFIGURED, &accel_dev->status);
+-}
+-
+ void adf_cfg_del_all_except(struct adf_accel_dev *accel_dev,
+ const char *section_name)
+ {
+--- a/drivers/crypto/intel/qat/qat_common/adf_cfg.h
++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.h
+@@ -34,7 +34,6 @@ void adf_cfg_dev_remove(struct adf_accel
+ void adf_cfg_dev_dbgfs_add(struct adf_accel_dev *accel_dev);
+ void adf_cfg_dev_dbgfs_rm(struct adf_accel_dev *accel_dev);
+ int adf_cfg_section_add(struct adf_accel_dev *accel_dev, const char *name);
+-void adf_cfg_del_all(struct adf_accel_dev *accel_dev);
+ void adf_cfg_del_all_except(struct adf_accel_dev *accel_dev,
+ const char *section_name);
+ int adf_cfg_add_key_value_param(struct adf_accel_dev *accel_dev,
+--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h
++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h
+@@ -4,18 +4,11 @@
+ #define ADF_CFG_COMMON_H_
+
+ #include <linux/types.h>
+-#include <linux/ioctl.h>
+
+ #define ADF_CFG_MAX_STR_LEN 64
+ #define ADF_CFG_MAX_KEY_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
+ #define ADF_CFG_MAX_VAL_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
+ #define ADF_CFG_MAX_SECTION_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN
+-#define ADF_CFG_BASE_DEC 10
+-#define ADF_CFG_BASE_HEX 16
+-#define ADF_CFG_ALL_DEVICES 0xFE
+-#define ADF_CFG_NO_DEVICE 0xFF
+-#define ADF_CFG_AFFINITY_WHATEVER 0xFF
+-#define MAX_DEVICE_NAME_SIZE 32
+ #define ADF_MAX_DEVICES (32 * 32)
+ #define ADF_DEVS_ARRAY_SIZE BITS_TO_LONGS(ADF_MAX_DEVICES)
+
+@@ -49,29 +42,4 @@ enum adf_device_type {
+ DEV_4XXX,
+ DEV_420XX,
+ };
+-
+-struct adf_dev_status_info {
+- enum adf_device_type type;
+- __u32 accel_id;
+- __u32 instance_id;
+- __u8 num_ae;
+- __u8 num_accel;
+- __u8 num_logical_accel;
+- __u8 banks_per_accel;
+- __u8 state;
+- __u8 bus;
+- __u8 dev;
+- __u8 fun;
+- char name[MAX_DEVICE_NAME_SIZE];
+-};
+-
+-#define ADF_CTL_IOC_MAGIC 'a'
+-#define IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS _IOW(ADF_CTL_IOC_MAGIC, 0, \
+- struct adf_user_cfg_ctl_data)
+-#define IOCTL_STOP_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 1, \
+- struct adf_user_cfg_ctl_data)
+-#define IOCTL_START_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 2, \
+- struct adf_user_cfg_ctl_data)
+-#define IOCTL_STATUS_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 3, __u32)
+-#define IOCTL_GET_NUM_DEVICES _IOW(ADF_CTL_IOC_MAGIC, 4, __s32)
+ #endif
+--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_user.h
++++ /dev/null
+@@ -1,38 +0,0 @@
+-/* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) */
+-/* Copyright(c) 2014 - 2020 Intel Corporation */
+-#ifndef ADF_CFG_USER_H_
+-#define ADF_CFG_USER_H_
+-
+-#include "adf_cfg_common.h"
+-#include "adf_cfg_strings.h"
+-
+-struct adf_user_cfg_key_val {
+- char key[ADF_CFG_MAX_KEY_LEN_IN_BYTES];
+- char val[ADF_CFG_MAX_VAL_LEN_IN_BYTES];
+- union {
+- struct adf_user_cfg_key_val *next;
+- __u64 padding3;
+- };
+- enum adf_cfg_val_type type;
+-} __packed;
+-
+-struct adf_user_cfg_section {
+- char name[ADF_CFG_MAX_SECTION_LEN_IN_BYTES];
+- union {
+- struct adf_user_cfg_key_val *params;
+- __u64 padding1;
+- };
+- union {
+- struct adf_user_cfg_section *next;
+- __u64 padding3;
+- };
+-} __packed;
+-
+-struct adf_user_cfg_ctl_data {
+- union {
+- struct adf_user_cfg_section *config_section;
+- __u64 padding;
+- };
+- __u8 device_id;
+-} __packed;
+-#endif
+--- a/drivers/crypto/intel/qat/qat_common/adf_common_drv.h
++++ b/drivers/crypto/intel/qat/qat_common/adf_common_drv.h
+@@ -68,11 +68,8 @@ int adf_devmgr_add_dev(struct adf_accel_
+ void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev,
+ struct adf_accel_dev *pf);
+ struct list_head *adf_devmgr_get_head(void);
+-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id);
+ struct adf_accel_dev *adf_devmgr_get_first(void);
+ struct adf_accel_dev *adf_devmgr_pci_to_accel_dev(struct pci_dev *pci_dev);
+-int adf_devmgr_verify_id(u32 id);
+-void adf_devmgr_get_num_dev(u32 *num);
+ int adf_devmgr_in_reset(struct adf_accel_dev *accel_dev);
+ int adf_dev_started(struct adf_accel_dev *accel_dev);
+ int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev);
+--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
+@@ -2,410 +2,13 @@
+ /* Copyright(c) 2014 - 2020 Intel Corporation */
+
+ #include <crypto/algapi.h>
++#include <linux/errno.h>
+ #include <linux/module.h>
+-#include <linux/mutex.h>
+-#include <linux/slab.h>
+-#include <linux/fs.h>
+-#include <linux/bitops.h>
+-#include <linux/pci.h>
+-#include <linux/cdev.h>
+-#include <linux/uaccess.h>
+
+-#include "adf_accel_devices.h"
+ #include "adf_common_drv.h"
+-#include "adf_cfg.h"
+-#include "adf_cfg_common.h"
+-#include "adf_cfg_user.h"
+-
+-#define ADF_CFG_MAX_SECTION 512
+-#define ADF_CFG_MAX_KEY_VAL 256
+-
+-#define DEVICE_NAME "qat_adf_ctl"
+-
+-static DEFINE_MUTEX(adf_ctl_lock);
+-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg);
+-
+-static const struct file_operations adf_ctl_ops = {
+- .owner = THIS_MODULE,
+- .unlocked_ioctl = adf_ctl_ioctl,
+- .compat_ioctl = compat_ptr_ioctl,
+-};
+-
+-static const struct class adf_ctl_class = {
+- .name = DEVICE_NAME,
+-};
+-
+-struct adf_ctl_drv_info {
+- unsigned int major;
+- struct cdev drv_cdev;
+-};
+-
+-static struct adf_ctl_drv_info adf_ctl_drv;
+-
+-static void adf_chr_drv_destroy(void)
+-{
+- device_destroy(&adf_ctl_class, MKDEV(adf_ctl_drv.major, 0));
+- cdev_del(&adf_ctl_drv.drv_cdev);
+- class_unregister(&adf_ctl_class);
+- unregister_chrdev_region(MKDEV(adf_ctl_drv.major, 0), 1);
+-}
+-
+-static int adf_chr_drv_create(void)
+-{
+- dev_t dev_id;
+- struct device *drv_device;
+- int ret;
+-
+- if (alloc_chrdev_region(&dev_id, 0, 1, DEVICE_NAME)) {
+- pr_err("QAT: unable to allocate chrdev region\n");
+- return -EFAULT;
+- }
+-
+- ret = class_register(&adf_ctl_class);
+- if (ret)
+- goto err_chrdev_unreg;
+-
+- adf_ctl_drv.major = MAJOR(dev_id);
+- cdev_init(&adf_ctl_drv.drv_cdev, &adf_ctl_ops);
+- if (cdev_add(&adf_ctl_drv.drv_cdev, dev_id, 1)) {
+- pr_err("QAT: cdev add failed\n");
+- goto err_class_destr;
+- }
+-
+- drv_device = device_create(&adf_ctl_class, NULL,
+- MKDEV(adf_ctl_drv.major, 0),
+- NULL, DEVICE_NAME);
+- if (IS_ERR(drv_device)) {
+- pr_err("QAT: failed to create device\n");
+- goto err_cdev_del;
+- }
+- return 0;
+-err_cdev_del:
+- cdev_del(&adf_ctl_drv.drv_cdev);
+-err_class_destr:
+- class_unregister(&adf_ctl_class);
+-err_chrdev_unreg:
+- unregister_chrdev_region(dev_id, 1);
+- return -EFAULT;
+-}
+-
+-static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg)
+-{
+- struct adf_user_cfg_ctl_data *cfg_data;
+-
+- cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data));
+- if (IS_ERR(cfg_data))
+- pr_err("QAT: failed to copy from user cfg_data.\n");
+- return cfg_data;
+-}
+-
+-static int adf_add_key_value_data(struct adf_accel_dev *accel_dev,
+- const char *section,
+- const struct adf_user_cfg_key_val *key_val)
+-{
+- if (key_val->type == ADF_HEX) {
+- long *ptr = (long *)key_val->val;
+- long val = *ptr;
+-
+- if (adf_cfg_add_key_value_param(accel_dev, section,
+- key_val->key, (void *)val,
+- key_val->type)) {
+- dev_err(&GET_DEV(accel_dev),
+- "failed to add hex keyvalue.\n");
+- return -EFAULT;
+- }
+- } else {
+- if (adf_cfg_add_key_value_param(accel_dev, section,
+- key_val->key, key_val->val,
+- key_val->type)) {
+- dev_err(&GET_DEV(accel_dev),
+- "failed to add keyvalue.\n");
+- return -EFAULT;
+- }
+- }
+- return 0;
+-}
+-
+-static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev,
+- struct adf_user_cfg_ctl_data *ctl_data)
+-{
+- struct adf_user_cfg_key_val key_val;
+- struct adf_user_cfg_key_val *params_head;
+- struct adf_user_cfg_section section, *section_head;
+- int i, j;
+-
+- section_head = ctl_data->config_section;
+-
+- for (i = 0; section_head && i < ADF_CFG_MAX_SECTION; i++) {
+- if (copy_from_user(§ion, (void __user *)section_head,
+- sizeof(*section_head))) {
+- dev_err(&GET_DEV(accel_dev),
+- "failed to copy section info\n");
+- goto out_err;
+- }
+-
+- if (adf_cfg_section_add(accel_dev, section.name)) {
+- dev_err(&GET_DEV(accel_dev),
+- "failed to add section.\n");
+- goto out_err;
+- }
+-
+- params_head = section.params;
+-
+- for (j = 0; params_head && j < ADF_CFG_MAX_KEY_VAL; j++) {
+- if (copy_from_user(&key_val, (void __user *)params_head,
+- sizeof(key_val))) {
+- dev_err(&GET_DEV(accel_dev),
+- "Failed to copy keyvalue.\n");
+- goto out_err;
+- }
+- if (adf_add_key_value_data(accel_dev, section.name,
+- &key_val)) {
+- goto out_err;
+- }
+- params_head = key_val.next;
+- }
+- section_head = section.next;
+- }
+- return 0;
+-out_err:
+- adf_cfg_del_all(accel_dev);
+- return -EFAULT;
+-}
+-
+-static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- struct adf_user_cfg_ctl_data *ctl_data;
+- struct adf_accel_dev *accel_dev;
+- int ret = 0;
+-
+- ctl_data = adf_ctl_alloc_resources(arg);
+- if (IS_ERR(ctl_data))
+- return PTR_ERR(ctl_data);
+-
+- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
+- if (!accel_dev) {
+- ret = -EFAULT;
+- goto out;
+- }
+-
+- if (adf_dev_started(accel_dev)) {
+- ret = -EFAULT;
+- goto out;
+- }
+-
+- if (adf_copy_key_value_data(accel_dev, ctl_data)) {
+- ret = -EFAULT;
+- goto out;
+- }
+- set_bit(ADF_STATUS_CONFIGURED, &accel_dev->status);
+-out:
+- kfree(ctl_data);
+- return ret;
+-}
+-
+-static int adf_ctl_is_device_in_use(int id)
+-{
+- struct adf_accel_dev *dev;
+-
+- list_for_each_entry(dev, adf_devmgr_get_head(), list) {
+- if (id == dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
+- if (adf_devmgr_in_reset(dev) || adf_dev_in_use(dev)) {
+- dev_info(&GET_DEV(dev),
+- "device qat_dev%d is busy\n",
+- dev->accel_id);
+- return -EBUSY;
+- }
+- }
+- }
+- return 0;
+-}
+-
+-static void adf_ctl_stop_devices(u32 id)
+-{
+- struct adf_accel_dev *accel_dev;
+-
+- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) {
+- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
+- if (!adf_dev_started(accel_dev))
+- continue;
+-
+- /* First stop all VFs */
+- if (!accel_dev->is_vf)
+- continue;
+-
+- adf_dev_down(accel_dev);
+- }
+- }
+-
+- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) {
+- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) {
+- if (!adf_dev_started(accel_dev))
+- continue;
+-
+- adf_dev_down(accel_dev);
+- }
+- }
+-}
+-
+-static int adf_ctl_ioctl_dev_stop(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- int ret;
+- struct adf_user_cfg_ctl_data *ctl_data;
+-
+- ctl_data = adf_ctl_alloc_resources(arg);
+- if (IS_ERR(ctl_data))
+- return PTR_ERR(ctl_data);
+-
+- if (adf_devmgr_verify_id(ctl_data->device_id)) {
+- pr_err("QAT: Device %d not found\n", ctl_data->device_id);
+- ret = -ENODEV;
+- goto out;
+- }
+-
+- ret = adf_ctl_is_device_in_use(ctl_data->device_id);
+- if (ret)
+- goto out;
+-
+- if (ctl_data->device_id == ADF_CFG_ALL_DEVICES)
+- pr_info("QAT: Stopping all acceleration devices.\n");
+- else
+- pr_info("QAT: Stopping acceleration device qat_dev%d.\n",
+- ctl_data->device_id);
+-
+- adf_ctl_stop_devices(ctl_data->device_id);
+-
+-out:
+- kfree(ctl_data);
+- return ret;
+-}
+-
+-static int adf_ctl_ioctl_dev_start(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- int ret;
+- struct adf_user_cfg_ctl_data *ctl_data;
+- struct adf_accel_dev *accel_dev;
+-
+- ctl_data = adf_ctl_alloc_resources(arg);
+- if (IS_ERR(ctl_data))
+- return PTR_ERR(ctl_data);
+-
+- ret = -ENODEV;
+- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
+- if (!accel_dev)
+- goto out;
+-
+- dev_info(&GET_DEV(accel_dev),
+- "Starting acceleration device qat_dev%d.\n",
+- ctl_data->device_id);
+-
+- ret = adf_dev_up(accel_dev, false);
+-
+- if (ret) {
+- dev_err(&GET_DEV(accel_dev), "Failed to start qat_dev%d\n",
+- ctl_data->device_id);
+- adf_dev_down(accel_dev);
+- }
+-out:
+- kfree(ctl_data);
+- return ret;
+-}
+-
+-static int adf_ctl_ioctl_get_num_devices(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- u32 num_devices = 0;
+-
+- adf_devmgr_get_num_dev(&num_devices);
+- if (copy_to_user((void __user *)arg, &num_devices, sizeof(num_devices)))
+- return -EFAULT;
+-
+- return 0;
+-}
+-
+-static int adf_ctl_ioctl_get_status(struct file *fp, unsigned int cmd,
+- unsigned long arg)
+-{
+- struct adf_hw_device_data *hw_data;
+- struct adf_dev_status_info dev_info;
+- struct adf_accel_dev *accel_dev;
+-
+- if (copy_from_user(&dev_info, (void __user *)arg,
+- sizeof(struct adf_dev_status_info))) {
+- pr_err("QAT: failed to copy from user.\n");
+- return -EFAULT;
+- }
+-
+- accel_dev = adf_devmgr_get_dev_by_id(dev_info.accel_id);
+- if (!accel_dev)
+- return -ENODEV;
+-
+- hw_data = accel_dev->hw_device;
+- dev_info.state = adf_dev_started(accel_dev) ? DEV_UP : DEV_DOWN;
+- dev_info.num_ae = hw_data->get_num_aes(hw_data);
+- dev_info.num_accel = hw_data->get_num_accels(hw_data);
+- dev_info.num_logical_accel = hw_data->num_logical_accel;
+- dev_info.banks_per_accel = hw_data->num_banks
+- / hw_data->num_logical_accel;
+- strscpy(dev_info.name, hw_data->dev_class->name, sizeof(dev_info.name));
+- dev_info.instance_id = hw_data->instance_id;
+- dev_info.type = hw_data->dev_class->type;
+- dev_info.bus = accel_to_pci_dev(accel_dev)->bus->number;
+- dev_info.dev = PCI_SLOT(accel_to_pci_dev(accel_dev)->devfn);
+- dev_info.fun = PCI_FUNC(accel_to_pci_dev(accel_dev)->devfn);
+-
+- if (copy_to_user((void __user *)arg, &dev_info,
+- sizeof(struct adf_dev_status_info))) {
+- dev_err(&GET_DEV(accel_dev), "failed to copy status.\n");
+- return -EFAULT;
+- }
+- return 0;
+-}
+-
+-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
+-{
+- int ret;
+-
+- if (mutex_lock_interruptible(&adf_ctl_lock))
+- return -EFAULT;
+-
+- switch (cmd) {
+- case IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS:
+- ret = adf_ctl_ioctl_dev_config(fp, cmd, arg);
+- break;
+-
+- case IOCTL_STOP_ACCEL_DEV:
+- ret = adf_ctl_ioctl_dev_stop(fp, cmd, arg);
+- break;
+-
+- case IOCTL_START_ACCEL_DEV:
+- ret = adf_ctl_ioctl_dev_start(fp, cmd, arg);
+- break;
+-
+- case IOCTL_GET_NUM_DEVICES:
+- ret = adf_ctl_ioctl_get_num_devices(fp, cmd, arg);
+- break;
+-
+- case IOCTL_STATUS_ACCEL_DEV:
+- ret = adf_ctl_ioctl_get_status(fp, cmd, arg);
+- break;
+- default:
+- pr_err_ratelimited("QAT: Invalid ioctl %d\n", cmd);
+- ret = -EFAULT;
+- break;
+- }
+- mutex_unlock(&adf_ctl_lock);
+- return ret;
+-}
+
+ static int __init adf_register_ctl_device_driver(void)
+ {
+- if (adf_chr_drv_create())
+- goto err_chr_dev;
+-
+ if (adf_init_misc_wq())
+ goto err_misc_wq;
+
+@@ -437,15 +40,11 @@ err_pf_wq:
+ err_aer:
+ adf_exit_misc_wq();
+ err_misc_wq:
+- adf_chr_drv_destroy();
+-err_chr_dev:
+- mutex_destroy(&adf_ctl_lock);
+ return -EFAULT;
+ }
+
+ static void __exit adf_unregister_ctl_device_driver(void)
+ {
+- adf_chr_drv_destroy();
+ adf_exit_misc_wq();
+ adf_exit_aer();
+ adf_exit_vf_wq();
+@@ -453,7 +52,6 @@ static void __exit adf_unregister_ctl_de
+ qat_crypto_unregister();
+ qat_compression_unregister();
+ adf_clean_vf_map(false);
+- mutex_destroy(&adf_ctl_lock);
+ }
+
+ module_init(adf_register_ctl_device_driver);
+--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c
+@@ -45,19 +45,6 @@ static struct vf_id_map *adf_find_vf(u32
+ return NULL;
+ }
+
+-static int adf_get_vf_real_id(u32 fake)
+-{
+- struct list_head *itr;
+-
+- list_for_each(itr, &vfs_table) {
+- struct vf_id_map *ptr =
+- list_entry(itr, struct vf_id_map, list);
+- if (ptr->fake_id == fake)
+- return ptr->id;
+- }
+- return -1;
+-}
+-
+ /**
+ * adf_clean_vf_map() - Cleans VF id mappings
+ * @vf: flag indicating whether mappings is cleaned
+@@ -314,63 +301,6 @@ struct adf_accel_dev *adf_devmgr_pci_to_
+ }
+ EXPORT_SYMBOL_GPL(adf_devmgr_pci_to_accel_dev);
+
+-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id)
+-{
+- struct list_head *itr;
+- int real_id;
+-
+- mutex_lock(&table_lock);
+- real_id = adf_get_vf_real_id(id);
+- if (real_id < 0)
+- goto unlock;
+-
+- id = real_id;
+-
+- list_for_each(itr, &accel_table) {
+- struct adf_accel_dev *ptr =
+- list_entry(itr, struct adf_accel_dev, list);
+- if (ptr->accel_id == id) {
+- mutex_unlock(&table_lock);
+- return ptr;
+- }
+- }
+-unlock:
+- mutex_unlock(&table_lock);
+- return NULL;
+-}
+-
+-int adf_devmgr_verify_id(u32 id)
+-{
+- if (id == ADF_CFG_ALL_DEVICES)
+- return 0;
+-
+- if (adf_devmgr_get_dev_by_id(id))
+- return 0;
+-
+- return -ENODEV;
+-}
+-
+-static int adf_get_num_dettached_vfs(void)
+-{
+- struct list_head *itr;
+- int vfs = 0;
+-
+- mutex_lock(&table_lock);
+- list_for_each(itr, &vfs_table) {
+- struct vf_id_map *ptr =
+- list_entry(itr, struct vf_id_map, list);
+- if (ptr->bdf != ~0 && !ptr->attached)
+- vfs++;
+- }
+- mutex_unlock(&table_lock);
+- return vfs;
+-}
+-
+-void adf_devmgr_get_num_dev(u32 *num)
+-{
+- *num = num_devices - adf_get_num_dettached_vfs();
+-}
+-
+ /**
+ * adf_dev_in_use() - Check whether accel_dev is currently in use
+ * @accel_dev: Pointer to acceleration device.
--- /dev/null
+From stable+bounces-268565-greg=kroah.com@vger.kernel.org Thu Jun 25 16:12:02 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 10:08:44 -0400
+Subject: crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()
+To: stable@vger.kernel.org
+Cc: Thorsten Blum <thorsten.blum@linux.dev>, Herbert Xu <herbert@gondor.apana.org.au>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625140846.2431963-3-sashal@kernel.org>
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+[ Upstream commit 1e26339703e2afd397037defa798682b2b93dcc0 ]
+
+Replace kzalloc() followed by copy_from_user() with memdup_user() to
+improve and simplify adf_ctl_alloc_resources(). memdup_user() returns
+either -ENOMEM or -EFAULT (instead of -EIO) if an error occurs.
+
+Remove the unnecessary device id initialization, since memdup_user()
+(like copy_from_user()) immediately overwrites it.
+
+No functional changes intended other than returning the more idiomatic
+error code -EFAULT.
+
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
+@@ -94,17 +94,10 @@ static int adf_ctl_alloc_resources(struc
+ {
+ struct adf_user_cfg_ctl_data *cfg_data;
+
+- cfg_data = kzalloc(sizeof(*cfg_data), GFP_KERNEL);
+- if (!cfg_data)
+- return -ENOMEM;
+-
+- /* Initialize device id to NO DEVICE as 0 is a valid device id */
+- cfg_data->device_id = ADF_CFG_NO_DEVICE;
+-
+- if (copy_from_user(cfg_data, (void __user *)arg, sizeof(*cfg_data))) {
++ cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data));
++ if (IS_ERR(cfg_data)) {
+ pr_err("QAT: failed to copy from user cfg_data.\n");
+- kfree(cfg_data);
+- return -EIO;
++ return PTR_ERR(cfg_data);
+ }
+
+ *ctl_data = cfg_data;
--- /dev/null
+From stable+bounces-268567-greg=kroah.com@vger.kernel.org Thu Jun 25 16:17:30 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 10:08:45 -0400
+Subject: crypto: qat - Return pointer directly in adf_ctl_alloc_resources
+To: stable@vger.kernel.org
+Cc: Herbert Xu <herbert@gondor.apana.org.au>, Thorsten Blum <thorsten.blum@linux.dev>, Giovanni Cabiddu <giovanni.cabiddu@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625140846.2431963-4-sashal@kernel.org>
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 5ce9891ea928208a915411ce8227f8c3e37e5ad9 ]
+
+Returning values through arguments is confusing and that has
+upset the compiler with the recent change to memdup_user:
+
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:308:26: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized]
+ 308 | ctl_data->device_id);
+ | ^~
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:294:39: note: ‘ctl_data’ was declared here
+ 294 | struct adf_user_cfg_ctl_data *ctl_data;
+ | ^~~~~~~~
+In function ‘adf_ctl_ioctl_dev_stop’,
+ inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:386:9:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:273:48: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized]
+ 273 | ret = adf_ctl_is_device_in_use(ctl_data->device_id);
+ | ~~~~~~~~^~~~~~~~~~~
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:261:39: note: ‘ctl_data’ was declared here
+ 261 | struct adf_user_cfg_ctl_data *ctl_data;
+ | ^~~~~~~~
+In function ‘adf_ctl_ioctl_dev_config’,
+ inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:382:9:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:192:54: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized]
+ 192 | accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
+ | ~~~~~~~~^~~~~~~~~~~
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’:
+../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:185:39: note: ‘ctl_data’ was declared here
+ 185 | struct adf_user_cfg_ctl_data *ctl_data;
+ | ^~~~~~~~
+
+Fix this by returning the pointer directly.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Thorsten Blum <thorsten.blum@linux.dev>
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 31 +++++++++-------------
+ 1 file changed, 13 insertions(+), 18 deletions(-)
+
+--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
+@@ -89,19 +89,14 @@ err_chrdev_unreg:
+ return -EFAULT;
+ }
+
+-static int adf_ctl_alloc_resources(struct adf_user_cfg_ctl_data **ctl_data,
+- unsigned long arg)
++static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg)
+ {
+ struct adf_user_cfg_ctl_data *cfg_data;
+
+ cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data));
+- if (IS_ERR(cfg_data)) {
++ if (IS_ERR(cfg_data))
+ pr_err("QAT: failed to copy from user cfg_data.\n");
+- return PTR_ERR(cfg_data);
+- }
+-
+- *ctl_data = cfg_data;
+- return 0;
++ return cfg_data;
+ }
+
+ static int adf_add_key_value_data(struct adf_accel_dev *accel_dev,
+@@ -181,13 +176,13 @@ out_err:
+ static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd,
+ unsigned long arg)
+ {
+- int ret;
+ struct adf_user_cfg_ctl_data *ctl_data;
+ struct adf_accel_dev *accel_dev;
++ int ret = 0;
+
+- ret = adf_ctl_alloc_resources(&ctl_data, arg);
+- if (ret)
+- return ret;
++ ctl_data = adf_ctl_alloc_resources(arg);
++ if (IS_ERR(ctl_data))
++ return PTR_ERR(ctl_data);
+
+ accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
+ if (!accel_dev) {
+@@ -260,9 +255,9 @@ static int adf_ctl_ioctl_dev_stop(struct
+ int ret;
+ struct adf_user_cfg_ctl_data *ctl_data;
+
+- ret = adf_ctl_alloc_resources(&ctl_data, arg);
+- if (ret)
+- return ret;
++ ctl_data = adf_ctl_alloc_resources(arg);
++ if (IS_ERR(ctl_data))
++ return PTR_ERR(ctl_data);
+
+ if (adf_devmgr_verify_id(ctl_data->device_id)) {
+ pr_err("QAT: Device %d not found\n", ctl_data->device_id);
+@@ -294,9 +289,9 @@ static int adf_ctl_ioctl_dev_start(struc
+ struct adf_user_cfg_ctl_data *ctl_data;
+ struct adf_accel_dev *accel_dev;
+
+- ret = adf_ctl_alloc_resources(&ctl_data, arg);
+- if (ret)
+- return ret;
++ ctl_data = adf_ctl_alloc_resources(arg);
++ if (IS_ERR(ctl_data))
++ return PTR_ERR(ctl_data);
+
+ ret = -ENODEV;
+ accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id);
--- /dev/null
+From stable+bounces-268566-greg=kroah.com@vger.kernel.org Thu Jun 25 16:16:21 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 10:08:43 -0400
+Subject: Documentation: ioctl-number: Extend "Include File" column width
+To: stable@vger.kernel.org
+Cc: Bagas Sanjaya <bagasdotme@gmail.com>, Haren Myneni <haren@linux.ibm.com>, Madhavan Srinivasan <maddy@linux.ibm.com>, Jonathan Corbet <corbet@lwn.net>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625140846.2431963-2-sashal@kernel.org>
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 15afd5def819e4df2a29cef6fcfa6ae7ba167c0f ]
+
+Extend width of "Include File" column to fit full path to
+papr-physical-attestation.h in later commit.
+
+Reviewed-by: Haren Myneni <haren@linux.ibm.com>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Link: https://lore.kernel.org/r/20250714015711.14525-3-bagasdotme@gmail.com
+Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/userspace-api/ioctl/ioctl-number.rst | 486 ++++++++++-----------
+ 1 file changed, 243 insertions(+), 243 deletions(-)
+
+--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
+@@ -66,330 +66,330 @@ This table lists ioctls visible from use
+ most drivers up to 2.6.31, but I know I am missing some. There has been
+ no attempt to list non-X86 architectures or ioctls from drivers/staging/.
+
+-==== ===== ======================================================= ================================================================
+-Code Seq# Include File Comments
++==== ===== ========================================================= ================================================================
++Code Seq# Include File Comments
+ (hex)
+-==== ===== ======================================================= ================================================================
+-0x00 00-1F linux/fs.h conflict!
+-0x00 00-1F scsi/scsi_ioctl.h conflict!
+-0x00 00-1F linux/fb.h conflict!
+-0x00 00-1F linux/wavefront.h conflict!
++==== ===== ========================================================= ================================================================
++0x00 00-1F linux/fs.h conflict!
++0x00 00-1F scsi/scsi_ioctl.h conflict!
++0x00 00-1F linux/fb.h conflict!
++0x00 00-1F linux/wavefront.h conflict!
+ 0x02 all linux/fd.h
+ 0x03 all linux/hdreg.h
+-0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these.
++0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these.
+ 0x06 all linux/lp.h
+ 0x07 9F-D0 linux/vmw_vmci_defs.h, uapi/linux/vm_sockets.h
+ 0x09 all linux/raid/md_u.h
+ 0x10 00-0F drivers/char/s390/vmcp.h
+ 0x10 10-1F arch/s390/include/uapi/sclp_ctl.h
+ 0x10 20-2F arch/s390/include/uapi/asm/hypfs.h
+-0x12 all linux/fs.h BLK* ioctls
++0x12 all linux/fs.h BLK* ioctls
+ linux/blkpg.h
+-0x15 all linux/fs.h FS_IOC_* ioctls
+-0x1b all InfiniBand Subsystem
+- <http://infiniband.sourceforge.net/>
++0x15 all linux/fs.h FS_IOC_* ioctls
++0x1b all InfiniBand Subsystem
++ <http://infiniband.sourceforge.net/>
+ 0x20 all drivers/cdrom/cm206.h
+ 0x22 all scsi/sg.h
+-0x3E 00-0F linux/counter.h <mailto:linux-iio@vger.kernel.org>
++0x3E 00-0F linux/counter.h <mailto:linux-iio@vger.kernel.org>
+ '!' 00-1F uapi/linux/seccomp.h
+-'#' 00-3F IEEE 1394 Subsystem
+- Block for the entire subsystem
++'#' 00-3F IEEE 1394 Subsystem
++ Block for the entire subsystem
+ '$' 00-0F linux/perf_counter.h, linux/perf_event.h
+-'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem
+- <mailto:alexander.shishkin@linux.intel.com>
++'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem
++ <mailto:alexander.shishkin@linux.intel.com>
+ '&' 00-07 drivers/firewire/nosy-user.h
+-'*' 00-1F uapi/linux/user_events.h User Events Subsystem
+- <mailto:linux-trace-kernel@vger.kernel.org>
+-'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl
+- <ftp://ftp.de.kernel.org/pub/linux/daemons/ntp/PPS/>
++'*' 00-1F uapi/linux/user_events.h User Events Subsystem
++ <mailto:linux-trace-kernel@vger.kernel.org>
++'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl
++ <ftp://ftp.de.kernel.org/pub/linux/daemons/ntp/PPS/>
+ '2' 01-04 linux/i2o.h
+-'3' 00-0F drivers/s390/char/raw3270.h conflict!
+-'3' 00-1F linux/suspend_ioctls.h, conflict!
++'3' 00-0F drivers/s390/char/raw3270.h conflict!
++'3' 00-1F linux/suspend_ioctls.h, conflict!
+ kernel/power/user.c
+-'8' all SNP8023 advanced NIC card
+- <mailto:mcr@solidum.com>
++'8' all SNP8023 advanced NIC card
++ <mailto:mcr@solidum.com>
+ ';' 64-7F linux/vfio.h
+ ';' 80-FF linux/iommufd.h
+-'=' 00-3f uapi/linux/ptp_clock.h <mailto:richardcochran@gmail.com>
+-'@' 00-0F linux/radeonfb.h conflict!
+-'@' 00-0F drivers/video/aty/aty128fb.c conflict!
+-'A' 00-1F linux/apm_bios.h conflict!
+-'A' 00-0F linux/agpgart.h, conflict!
++'=' 00-3f uapi/linux/ptp_clock.h <mailto:richardcochran@gmail.com>
++'@' 00-0F linux/radeonfb.h conflict!
++'@' 00-0F drivers/video/aty/aty128fb.c conflict!
++'A' 00-1F linux/apm_bios.h conflict!
++'A' 00-0F linux/agpgart.h, conflict!
+ drivers/char/agp/compat_ioctl.h
+-'A' 00-7F sound/asound.h conflict!
+-'B' 00-1F linux/cciss_ioctl.h conflict!
+-'B' 00-0F include/linux/pmu.h conflict!
+-'B' C0-FF advanced bbus <mailto:maassen@uni-freiburg.de>
+-'B' 00-0F xen/xenbus_dev.h conflict!
+-'C' all linux/soundcard.h conflict!
+-'C' 01-2F linux/capi.h conflict!
+-'C' F0-FF drivers/net/wan/cosa.h conflict!
++'A' 00-7F sound/asound.h conflict!
++'B' 00-1F linux/cciss_ioctl.h conflict!
++'B' 00-0F include/linux/pmu.h conflict!
++'B' C0-FF advanced bbus <mailto:maassen@uni-freiburg.de>
++'B' 00-0F xen/xenbus_dev.h conflict!
++'C' all linux/soundcard.h conflict!
++'C' 01-2F linux/capi.h conflict!
++'C' F0-FF drivers/net/wan/cosa.h conflict!
+ 'D' all arch/s390/include/asm/dasd.h
+-'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h Dead since 2022
++'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h Dead since 2022
+ 'D' 05 drivers/scsi/pmcraid.h
+-'E' all linux/input.h conflict!
+-'E' 00-0F xen/evtchn.h conflict!
+-'F' all linux/fb.h conflict!
+-'F' 01-02 drivers/scsi/pmcraid.h conflict!
+-'F' 20 drivers/video/fsl-diu-fb.h conflict!
+-'F' 20 linux/ivtvfb.h conflict!
+-'F' 20 linux/matroxfb.h conflict!
+-'F' 20 drivers/video/aty/atyfb_base.c conflict!
+-'F' 00-0F video/da8xx-fb.h conflict!
+-'F' 80-8F linux/arcfb.h conflict!
+-'F' DD video/sstfb.h conflict!
+-'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict!
+-'G' 00-0F xen/gntalloc.h, xen/gntdev.h conflict!
+-'H' 00-7F linux/hiddev.h conflict!
+-'H' 00-0F linux/hidraw.h conflict!
+-'H' 01 linux/mei.h conflict!
+-'H' 02 linux/mei.h conflict!
+-'H' 03 linux/mei.h conflict!
+-'H' 00-0F sound/asound.h conflict!
+-'H' 20-40 sound/asound_fm.h conflict!
+-'H' 80-8F sound/sfnt_info.h conflict!
+-'H' 10-8F sound/emu10k1.h conflict!
+-'H' 10-1F sound/sb16_csp.h conflict!
+-'H' 10-1F sound/hda_hwdep.h conflict!
+-'H' 40-4F sound/hdspm.h conflict!
+-'H' 40-4F sound/hdsp.h conflict!
++'E' all linux/input.h conflict!
++'E' 00-0F xen/evtchn.h conflict!
++'F' all linux/fb.h conflict!
++'F' 01-02 drivers/scsi/pmcraid.h conflict!
++'F' 20 drivers/video/fsl-diu-fb.h conflict!
++'F' 20 linux/ivtvfb.h conflict!
++'F' 20 linux/matroxfb.h conflict!
++'F' 20 drivers/video/aty/atyfb_base.c conflict!
++'F' 00-0F video/da8xx-fb.h conflict!
++'F' 80-8F linux/arcfb.h conflict!
++'F' DD video/sstfb.h conflict!
++'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict!
++'G' 00-0F xen/gntalloc.h, xen/gntdev.h conflict!
++'H' 00-7F linux/hiddev.h conflict!
++'H' 00-0F linux/hidraw.h conflict!
++'H' 01 linux/mei.h conflict!
++'H' 02 linux/mei.h conflict!
++'H' 03 linux/mei.h conflict!
++'H' 00-0F sound/asound.h conflict!
++'H' 20-40 sound/asound_fm.h conflict!
++'H' 80-8F sound/sfnt_info.h conflict!
++'H' 10-8F sound/emu10k1.h conflict!
++'H' 10-1F sound/sb16_csp.h conflict!
++'H' 10-1F sound/hda_hwdep.h conflict!
++'H' 40-4F sound/hdspm.h conflict!
++'H' 40-4F sound/hdsp.h conflict!
+ 'H' 90 sound/usb/usx2y/usb_stream.h
+-'H' 00-0F uapi/misc/habanalabs.h conflict!
++'H' 00-0F uapi/misc/habanalabs.h conflict!
+ 'H' A0 uapi/linux/usb/cdc-wdm.h
+-'H' C0-F0 net/bluetooth/hci.h conflict!
+-'H' C0-DF net/bluetooth/hidp/hidp.h conflict!
+-'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict!
+-'H' C0-DF net/bluetooth/bnep/bnep.h conflict!
+-'H' F1 linux/hid-roccat.h <mailto:erazor_de@users.sourceforge.net>
++'H' C0-F0 net/bluetooth/hci.h conflict!
++'H' C0-DF net/bluetooth/hidp/hidp.h conflict!
++'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict!
++'H' C0-DF net/bluetooth/bnep/bnep.h conflict!
++'H' F1 linux/hid-roccat.h <mailto:erazor_de@users.sourceforge.net>
+ 'H' F8-FA sound/firewire.h
+-'I' all linux/isdn.h conflict!
+-'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict!
+-'I' 40-4F linux/mISDNif.h conflict!
++'I' all linux/isdn.h conflict!
++'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict!
++'I' 40-4F linux/mISDNif.h conflict!
+ 'K' all linux/kd.h
+-'L' 00-1F linux/loop.h conflict!
+-'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict!
+-'L' E0-FF linux/ppdd.h encrypted disk device driver
+- <http://linux01.gwdg.de/~alatham/ppdd.html>
+-'M' all linux/soundcard.h conflict!
+-'M' 01-16 mtd/mtd-abi.h conflict!
++'L' 00-1F linux/loop.h conflict!
++'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict!
++'L' E0-FF linux/ppdd.h encrypted disk device driver
++ <http://linux01.gwdg.de/~alatham/ppdd.html>
++'M' all linux/soundcard.h conflict!
++'M' 01-16 mtd/mtd-abi.h conflict!
+ and drivers/mtd/mtdchar.c
+ 'M' 01-03 drivers/scsi/megaraid/megaraid_sas.h
+-'M' 00-0F drivers/video/fsl-diu-fb.h conflict!
++'M' 00-0F drivers/video/fsl-diu-fb.h conflict!
+ 'N' 00-1F drivers/usb/scanner.h
+ 'N' 40-7F drivers/block/nvme.c
+-'N' 80-8F uapi/linux/ntsync.h NT synchronization primitives
+- <mailto:wine-devel@winehq.org>
+-'O' 00-06 mtd/ubi-user.h UBI
+-'P' all linux/soundcard.h conflict!
+-'P' 60-6F sound/sscape_ioctl.h conflict!
+-'P' 00-0F drivers/usb/class/usblp.c conflict!
+-'P' 01-09 drivers/misc/pci_endpoint_test.c conflict!
+-'P' 00-0F xen/privcmd.h conflict!
+-'P' 00-05 linux/tps6594_pfsm.h conflict!
++'N' 80-8F uapi/linux/ntsync.h NT synchronization primitives
++ <mailto:wine-devel@winehq.org>
++'O' 00-06 mtd/ubi-user.h UBI
++'P' all linux/soundcard.h conflict!
++'P' 60-6F sound/sscape_ioctl.h conflict!
++'P' 00-0F drivers/usb/class/usblp.c conflict!
++'P' 01-09 drivers/misc/pci_endpoint_test.c conflict!
++'P' 00-0F xen/privcmd.h conflict!
++'P' 00-05 linux/tps6594_pfsm.h conflict!
+ 'Q' all linux/soundcard.h
+-'R' 00-1F linux/random.h conflict!
+-'R' 01 linux/rfkill.h conflict!
++'R' 00-1F linux/random.h conflict!
++'R' 01 linux/rfkill.h conflict!
+ 'R' 20-2F linux/trace_mmap.h
+ 'R' C0-DF net/bluetooth/rfcomm.h
+ 'R' E0 uapi/linux/fsl_mc.h
+-'S' all linux/cdrom.h conflict!
+-'S' 80-81 scsi/scsi_ioctl.h conflict!
+-'S' 82-FF scsi/scsi.h conflict!
+-'S' 00-7F sound/asequencer.h conflict!
+-'T' all linux/soundcard.h conflict!
+-'T' 00-AF sound/asound.h conflict!
+-'T' all arch/x86/include/asm/ioctls.h conflict!
+-'T' C0-DF linux/if_tun.h conflict!
+-'U' all sound/asound.h conflict!
+-'U' 00-CF linux/uinput.h conflict!
++'S' all linux/cdrom.h conflict!
++'S' 80-81 scsi/scsi_ioctl.h conflict!
++'S' 82-FF scsi/scsi.h conflict!
++'S' 00-7F sound/asequencer.h conflict!
++'T' all linux/soundcard.h conflict!
++'T' 00-AF sound/asound.h conflict!
++'T' all arch/x86/include/asm/ioctls.h conflict!
++'T' C0-DF linux/if_tun.h conflict!
++'U' all sound/asound.h conflict!
++'U' 00-CF linux/uinput.h conflict!
+ 'U' 00-EF linux/usbdevice_fs.h
+ 'U' C0-CF drivers/bluetooth/hci_uart.h
+-'V' all linux/vt.h conflict!
+-'V' all linux/videodev2.h conflict!
+-'V' C0 linux/ivtvfb.h conflict!
+-'V' C0 linux/ivtv.h conflict!
+-'V' C0 media/si4713.h conflict!
+-'W' 00-1F linux/watchdog.h conflict!
+-'W' 00-1F linux/wanrouter.h conflict! (pre 3.9)
+-'W' 00-3F sound/asound.h conflict!
++'V' all linux/vt.h conflict!
++'V' all linux/videodev2.h conflict!
++'V' C0 linux/ivtvfb.h conflict!
++'V' C0 linux/ivtv.h conflict!
++'V' C0 media/si4713.h conflict!
++'W' 00-1F linux/watchdog.h conflict!
++'W' 00-1F linux/wanrouter.h conflict! (pre 3.9)
++'W' 00-3F sound/asound.h conflict!
+ 'W' 40-5F drivers/pci/switch/switchtec.c
+ 'W' 60-61 linux/watch_queue.h
+-'X' all fs/xfs/xfs_fs.h, conflict!
++'X' all fs/xfs/xfs_fs.h, conflict!
+ fs/xfs/linux-2.6/xfs_ioctl32.h,
+ include/linux/falloc.h,
+ linux/fs.h,
+-'X' all fs/ocfs2/ocfs_fs.h conflict!
+-'X' 01 linux/pktcdvd.h conflict!
++'X' all fs/ocfs2/ocfs_fs.h conflict!
++'X' 01 linux/pktcdvd.h conflict!
+ 'Z' 14-15 drivers/message/fusion/mptctl.h
+-'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices
+- <mailto:gregkh@linuxfoundation.org>
+-'a' all linux/atm*.h, linux/sonet.h ATM on linux
+- <http://lrcwww.epfl.ch/>
+-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver
+-'b' 00-FF conflict! bit3 vme host bridge
+- <mailto:natalia@nikhefk.nikhef.nl>
+-'b' 00-0F linux/dma-buf.h conflict!
+-'c' 00-7F linux/comstats.h conflict!
+-'c' 00-7F linux/coda.h conflict!
+-'c' 00-1F linux/chio.h conflict!
+-'c' 80-9F arch/s390/include/asm/chsc.h conflict!
++'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices
++ <mailto:gregkh@linuxfoundation.org>
++'a' all linux/atm*.h, linux/sonet.h ATM on linux
++ <http://lrcwww.epfl.ch/>
++'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver
++'b' 00-FF conflict! bit3 vme host bridge
++ <mailto:natalia@nikhefk.nikhef.nl>
++'b' 00-0F linux/dma-buf.h conflict!
++'c' 00-7F linux/comstats.h conflict!
++'c' 00-7F linux/coda.h conflict!
++'c' 00-1F linux/chio.h conflict!
++'c' 80-9F arch/s390/include/asm/chsc.h conflict!
+ 'c' A0-AF arch/x86/include/asm/msr.h conflict!
+-'d' 00-FF linux/char/drm/drm.h conflict!
+-'d' 02-40 pcmcia/ds.h conflict!
++'d' 00-FF linux/char/drm/drm.h conflict!
++'d' 02-40 pcmcia/ds.h conflict!
+ 'd' F0-FF linux/digi1.h
+-'e' all linux/digi1.h conflict!
+-'f' 00-1F linux/ext2_fs.h conflict!
+-'f' 00-1F linux/ext3_fs.h conflict!
+-'f' 00-0F fs/jfs/jfs_dinode.h conflict!
+-'f' 00-0F fs/ext4/ext4.h conflict!
+-'f' 00-0F linux/fs.h conflict!
+-'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict!
++'e' all linux/digi1.h conflict!
++'f' 00-1F linux/ext2_fs.h conflict!
++'f' 00-1F linux/ext3_fs.h conflict!
++'f' 00-0F fs/jfs/jfs_dinode.h conflict!
++'f' 00-0F fs/ext4/ext4.h conflict!
++'f' 00-0F linux/fs.h conflict!
++'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict!
+ 'f' 13-27 linux/fscrypt.h
+ 'f' 81-8F linux/fsverity.h
+ 'g' 00-0F linux/usb/gadgetfs.h
+ 'g' 20-2F linux/usb/g_printer.h
+-'h' 00-7F conflict! Charon filesystem
+- <mailto:zapman@interlan.net>
+-'h' 00-1F linux/hpet.h conflict!
++'h' 00-7F conflict! Charon filesystem
++ <mailto:zapman@interlan.net>
++'h' 00-1F linux/hpet.h conflict!
+ 'h' 80-8F fs/hfsplus/ioctl.c
+-'i' 00-3F linux/i2o-dev.h conflict!
+-'i' 0B-1F linux/ipmi.h conflict!
++'i' 00-3F linux/i2o-dev.h conflict!
++'i' 0B-1F linux/ipmi.h conflict!
+ 'i' 80-8F linux/i8k.h
+-'i' 90-9F `linux/iio/*.h` IIO
++'i' 90-9F `linux/iio/*.h` IIO
+ 'j' 00-3F linux/joystick.h
+-'k' 00-0F linux/spi/spidev.h conflict!
+-'k' 00-05 video/kyro.h conflict!
+-'k' 10-17 linux/hsi/hsi_char.h HSI character device
+-'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system
+- <http://web.archive.org/web/%2A/http://mikonos.dia.unisa.it/tcfs>
+-'l' 40-7F linux/udf_fs_i.h in development:
+- <https://github.com/pali/udftools>
+-'m' 00-09 linux/mmtimer.h conflict!
+-'m' all linux/mtio.h conflict!
+-'m' all linux/soundcard.h conflict!
+-'m' all linux/synclink.h conflict!
+-'m' 00-19 drivers/message/fusion/mptctl.h conflict!
+-'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict!
++'k' 00-0F linux/spi/spidev.h conflict!
++'k' 00-05 video/kyro.h conflict!
++'k' 10-17 linux/hsi/hsi_char.h HSI character device
++'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system
++ <http://web.archive.org/web/%2A/http://mikonos.dia.unisa.it/tcfs>
++'l' 40-7F linux/udf_fs_i.h in development:
++ <https://github.com/pali/udftools>
++'m' 00-09 linux/mmtimer.h conflict!
++'m' all linux/mtio.h conflict!
++'m' all linux/soundcard.h conflict!
++'m' all linux/synclink.h conflict!
++'m' 00-19 drivers/message/fusion/mptctl.h conflict!
++'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict!
+ 'n' 00-7F linux/ncp_fs.h and fs/ncpfs/ioctl.c
+-'n' 80-8F uapi/linux/nilfs2_api.h NILFS2
+-'n' E0-FF linux/matroxfb.h matroxfb
+-'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2
+-'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps)
+-'o' 40-41 mtd/ubi-user.h UBI
+-'o' 01-A1 `linux/dvb/*.h` DVB
+-'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this)
+-'p' 00-1F linux/rtc.h conflict!
++'n' 80-8F uapi/linux/nilfs2_api.h NILFS2
++'n' E0-FF linux/matroxfb.h matroxfb
++'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2
++'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps)
++'o' 40-41 mtd/ubi-user.h UBI
++'o' 01-A1 `linux/dvb/*.h` DVB
++'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this)
++'p' 00-1F linux/rtc.h conflict!
+ 'p' 40-7F linux/nvram.h
+-'p' 80-9F linux/ppdev.h user-space parport
+- <mailto:tim@cyberelk.net>
+-'p' A1-A5 linux/pps.h LinuxPPS
+- <mailto:giometti@linux.it>
++'p' 80-9F linux/ppdev.h user-space parport
++ <mailto:tim@cyberelk.net>
++'p' A1-A5 linux/pps.h LinuxPPS
++ <mailto:giometti@linux.it>
+ 'q' 00-1F linux/serio.h
+-'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK
+- linux/ixjuser.h <http://web.archive.org/web/%2A/http://www.quicknet.net>
++'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK
++ linux/ixjuser.h <http://web.archive.org/web/%2A/http://www.quicknet.net>
+ 'r' 00-1F linux/msdos_fs.h and fs/fat/dir.c
+ 's' all linux/cdk.h
+ 't' 00-7F linux/ppp-ioctl.h
+ 't' 80-8F linux/isdn_ppp.h
+-'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM
+-'u' 00-1F linux/smb_fs.h gone
+-'u' 00-2F linux/ublk_cmd.h conflict!
+-'u' 20-3F linux/uvcvideo.h USB video class host driver
+-'u' 40-4f linux/udmabuf.h userspace dma-buf misc device
+-'v' 00-1F linux/ext2_fs.h conflict!
+-'v' 00-1F linux/fs.h conflict!
+-'v' 00-0F linux/sonypi.h conflict!
+-'v' 00-0F media/v4l2-subdev.h conflict!
+-'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API
+-'v' C0-FF linux/meye.h conflict!
+-'w' all CERN SCI driver
+-'y' 00-1F packet based user level communications
+- <mailto:zapman@interlan.net>
+-'z' 00-3F CAN bus card conflict!
+- <mailto:hdstich@connectu.ulm.circular.de>
+-'z' 40-7F CAN bus card conflict!
+- <mailto:oe@port.de>
+-'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict!
++'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM
++'u' 00-1F linux/smb_fs.h gone
++'u' 00-2F linux/ublk_cmd.h conflict!
++'u' 20-3F linux/uvcvideo.h USB video class host driver
++'u' 40-4f linux/udmabuf.h userspace dma-buf misc device
++'v' 00-1F linux/ext2_fs.h conflict!
++'v' 00-1F linux/fs.h conflict!
++'v' 00-0F linux/sonypi.h conflict!
++'v' 00-0F media/v4l2-subdev.h conflict!
++'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API
++'v' C0-FF linux/meye.h conflict!
++'w' all CERN SCI driver
++'y' 00-1F packet based user level communications
++ <mailto:zapman@interlan.net>
++'z' 00-3F CAN bus card conflict!
++ <mailto:hdstich@connectu.ulm.circular.de>
++'z' 40-7F CAN bus card conflict!
++ <mailto:oe@port.de>
++'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict!
+ '|' 00-7F linux/media.h
+ 0x80 00-1F linux/fb.h
+ 0x81 00-1F linux/vduse.h
+ 0x89 00-06 arch/x86/include/asm/sockios.h
+ 0x89 0B-DF linux/sockios.h
+-0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range
+-0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range
++0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range
++0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range
+ 0x8A 00-1F linux/eventpoll.h
+ 0x8B all linux/wireless.h
+-0x8C 00-3F WiNRADiO driver
+- <http://www.winradio.com.au/>
++0x8C 00-3F WiNRADiO driver
++ <http://www.winradio.com.au/>
+ 0x90 00 drivers/cdrom/sbpcd.h
+ 0x92 00-0F drivers/usb/mon/mon_bin.c
+ 0x93 60-7F linux/auto_fs.h
+-0x94 all fs/btrfs/ioctl.h Btrfs filesystem
+- and linux/fs.h some lifted to vfs/generic
+-0x97 00-7F fs/ceph/ioctl.h Ceph file system
+-0x99 00-0F 537-Addinboard driver
+- <mailto:buk@buks.ipn.de>
+-0xA0 all linux/sdp/sdp.h Industrial Device Project
+- <mailto:kenji@bitgate.com>
+-0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver
+-0xA2 all uapi/linux/acrn.h ACRN hypervisor
+-0xA3 80-8F Port ACL in development:
+- <mailto:tlewis@mindspring.com>
++0x94 all fs/btrfs/ioctl.h Btrfs filesystem
++ and linux/fs.h some lifted to vfs/generic
++0x97 00-7F fs/ceph/ioctl.h Ceph file system
++0x99 00-0F 537-Addinboard driver
++ <mailto:buk@buks.ipn.de>
++0xA0 all linux/sdp/sdp.h Industrial Device Project
++ <mailto:kenji@bitgate.com>
++0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver
++0xA2 all uapi/linux/acrn.h ACRN hypervisor
++0xA3 80-8F Port ACL in development:
++ <mailto:tlewis@mindspring.com>
+ 0xA3 90-9F linux/dtlk.h
+-0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
+-0xA4 00-1F uapi/asm/sgx.h <mailto:linux-sgx@vger.kernel.org>
+-0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator
+- <mailto:luzmaximilian@gmail.com>
+-0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver
+- <mailto:luzmaximilian@gmail.com>
++0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
++0xA4 00-1F uapi/asm/sgx.h <mailto:linux-sgx@vger.kernel.org>
++0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator
++ <mailto:luzmaximilian@gmail.com>
++0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver
++ <mailto:luzmaximilian@gmail.com>
+ 0xAA 00-3F linux/uapi/linux/userfaultfd.h
+ 0xAB 00-1F linux/nbd.h
+ 0xAC 00-1F linux/raw.h
+-0xAD 00 Netfilter device in development:
+- <mailto:rusty@rustcorp.com.au>
+-0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine
+- <mailto:kvm@vger.kernel.org>
+-0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine
+- <mailto:kvm@vger.kernel.org>
+-0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves
+-0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor
+-0xB0 all RATIO devices in development:
+- <mailto:vgo@ratio.de>
+-0xB1 00-1F PPPoX
+- <mailto:mostrows@styx.uwaterloo.ca>
+-0xB2 00 arch/powerpc/include/uapi/asm/papr-vpd.h powerpc/pseries VPD API
+- <mailto:linuxppc-dev@lists.ozlabs.org>
+-0xB2 01-02 arch/powerpc/include/uapi/asm/papr-sysparm.h powerpc/pseries system parameter API
+- <mailto:linuxppc-dev@lists.ozlabs.org>
++0xAD 00 Netfilter device in development:
++ <mailto:rusty@rustcorp.com.au>
++0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine
++ <mailto:kvm@vger.kernel.org>
++0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine
++ <mailto:kvm@vger.kernel.org>
++0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves
++0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor
++0xB0 all RATIO devices in development:
++ <mailto:vgo@ratio.de>
++0xB1 00-1F PPPoX
++ <mailto:mostrows@styx.uwaterloo.ca>
++0xB2 00 arch/powerpc/include/uapi/asm/papr-vpd.h powerpc/pseries VPD API
++ <mailto:linuxppc-dev@lists.ozlabs.org>
++0xB2 01-02 arch/powerpc/include/uapi/asm/papr-sysparm.h powerpc/pseries system parameter API
++ <mailto:linuxppc-dev@lists.ozlabs.org>
+ 0xB3 00 linux/mmc/ioctl.h
+-0xB4 00-0F linux/gpio.h <mailto:linux-gpio@vger.kernel.org>
+-0xB5 00-0F uapi/linux/rpmsg.h <mailto:linux-remoteproc@vger.kernel.org>
++0xB4 00-0F linux/gpio.h <mailto:linux-gpio@vger.kernel.org>
++0xB5 00-0F uapi/linux/rpmsg.h <mailto:linux-remoteproc@vger.kernel.org>
+ 0xB6 all linux/fpga-dfl.h
+-0xB7 all uapi/linux/remoteproc_cdev.h <mailto:linux-remoteproc@vger.kernel.org>
+-0xB7 all uapi/linux/nsfs.h <mailto:Andrei Vagin <avagin@openvz.org>>
+-0xB8 01-02 uapi/misc/mrvl_cn10k_dpi.h Marvell CN10K DPI driver
++0xB7 all uapi/linux/remoteproc_cdev.h <mailto:linux-remoteproc@vger.kernel.org>
++0xB7 all uapi/linux/nsfs.h <mailto:Andrei Vagin <avagin@openvz.org>>
++0xB8 01-02 uapi/misc/mrvl_cn10k_dpi.h Marvell CN10K DPI driver
+ 0xC0 00-0F linux/usb/iowarrior.h
+ 0xCA 00-0F uapi/misc/cxl.h
+ 0xCA 10-2F uapi/misc/ocxl.h
+ 0xCA 80-BF uapi/scsi/cxlflash_ioctl.h
+-0xCB 00-1F CBM serial IEC bus in development:
+- <mailto:michael.klein@puffin.lb.shuttle.de>
+-0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver
++0xCB 00-1F CBM serial IEC bus in development:
++ <mailto:michael.klein@puffin.lb.shuttle.de>
++0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver
+ 0xCD 01 linux/reiserfs_fs.h
+-0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices
++0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices
+ 0xCF 02 fs/smb/client/cifs_ioctl.h
+ 0xDB 00-0F drivers/char/mwave/mwavepub.h
+-0xDD 00-3F ZFCP device driver see drivers/s390/scsi/
+- <mailto:aherrman@de.ibm.com>
++0xDD 00-3F ZFCP device driver see drivers/s390/scsi/
++ <mailto:aherrman@de.ibm.com>
+ 0xE5 00-3F linux/fuse.h
+-0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver
+-0xEE 00-09 uapi/linux/pfrut.h Platform Firmware Runtime Update and Telemetry
+-0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development)
+- <mailto:thomas@winischhofer.net>
+-0xF6 all LTTng Linux Trace Toolkit Next Generation
+- <mailto:mathieu.desnoyers@efficios.com>
+-0xF8 all arch/x86/include/uapi/asm/amd_hsmp.h AMD HSMP EPYC system management interface driver
+- <mailto:nchatrad@amd.com>
++0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver
++0xEE 00-09 uapi/linux/pfrut.h Platform Firmware Runtime Update and Telemetry
++0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development)
++ <mailto:thomas@winischhofer.net>
++0xF6 all LTTng Linux Trace Toolkit Next Generation
++ <mailto:mathieu.desnoyers@efficios.com>
++0xF8 all arch/x86/include/uapi/asm/amd_hsmp.h AMD HSMP EPYC system management interface driver
++ <mailto:nchatrad@amd.com>
+ 0xFD all linux/dm-ioctl.h
+ 0xFE all linux/isst_if.h
+-==== ===== ======================================================= ================================================================
++==== ===== ========================================================= ================================================================
--- /dev/null
+From stable+bounces-268564-greg=kroah.com@vger.kernel.org Thu Jun 25 16:16:13 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 10:08:42 -0400
+Subject: Documentation: ioctl-number: Fix linuxppc-dev mailto link
+To: stable@vger.kernel.org
+Cc: Bagas Sanjaya <bagasdotme@gmail.com>, Haren Myneni <haren@linux.ibm.com>, Madhavan Srinivasan <maddy@linux.ibm.com>, Jonathan Corbet <corbet@lwn.net>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625140846.2431963-1-sashal@kernel.org>
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 3dfa97bd93614c15418ba7b5c727f6c5bb617174 ]
+
+Spell out full Linux PPC mailing list address like other subsystem
+mailing lists listed in the table.
+
+Reviewed-by: Haren Myneni <haren@linux.ibm.com>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Link: https://lore.kernel.org/r/20250714015711.14525-2-bagasdotme@gmail.com
+Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/userspace-api/ioctl/ioctl-number.rst | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
+@@ -358,9 +358,9 @@ Code Seq# Include File
+ 0xB1 00-1F PPPoX
+ <mailto:mostrows@styx.uwaterloo.ca>
+ 0xB2 00 arch/powerpc/include/uapi/asm/papr-vpd.h powerpc/pseries VPD API
+- <mailto:linuxppc-dev>
++ <mailto:linuxppc-dev@lists.ozlabs.org>
+ 0xB2 01-02 arch/powerpc/include/uapi/asm/papr-sysparm.h powerpc/pseries system parameter API
+- <mailto:linuxppc-dev>
++ <mailto:linuxppc-dev@lists.ozlabs.org>
+ 0xB3 00 linux/mmc/ioctl.h
+ 0xB4 00-0F linux/gpio.h <mailto:linux-gpio@vger.kernel.org>
+ 0xB5 00-0F uapi/linux/rpmsg.h <mailto:linux-remoteproc@vger.kernel.org>
--- /dev/null
+From stable+bounces-268562-greg=kroah.com@vger.kernel.org Thu Jun 25 16:06:48 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 10:06:04 -0400
+Subject: drivers/base/memory: set mem->altmap after successful device registration
+To: stable@vger.kernel.org
+Cc: Georgi Djakov <georgi.djakov@oss.qualcomm.com>, "Oscar Salvador (SUSE)" <osalvador@kernel.org>, Vishal Verma <vishal.l.verma@intel.com>, Mike Rapoport <rppt@kernel.org>, Richard Cheng <icheng@nvidia.com>, David Hildenbrand <david@kernel.org>, Georgi Djakov <djakov@kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, "Rafael J. Wysocki" <rafael@kernel.org>, Andrew Morton <akpm@linux-foundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625140604.2429376-1-sashal@kernel.org>
+
+From: Georgi Djakov <georgi.djakov@oss.qualcomm.com>
+
+[ Upstream commit a2b8d7827f48ee54a686cb80e4a1d0ff954ec42a ]
+
+If __add_memory_block() fails at xa_store() (under memory pressure for
+example), device_unregister() is called, which eventually triggers
+memory_block_release() with mem->altmap still set, causing a
+WARN_ON(mem->altmap). This was triggered by modifying virtio-mem driver.
+
+Fix this by delaying the assignment of mem->altmap until after
+__add_memory_block() has succeeded.
+
+Link: https://lore.kernel.org/20260514092657.3057141-1-georgi.djakov@oss.qualcomm.com
+Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block")
+Signed-off-by: Georgi Djakov <georgi.djakov@oss.qualcomm.com>
+Acked-by: Oscar Salvador (SUSE) <osalvador@kernel.org>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Richard Cheng <icheng@nvidia.com>
+Cc: David Hildenbrand <david@kernel.org>
+Cc: Georgi Djakov <djakov@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/memory.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -794,7 +794,6 @@ static int add_memory_block(unsigned lon
+ mem->start_section_nr = block_id * sections_per_block;
+ mem->state = state;
+ mem->nid = NUMA_NO_NODE;
+- mem->altmap = altmap;
+ INIT_LIST_HEAD(&mem->group_next);
+
+ #ifndef CONFIG_NUMA
+@@ -812,6 +811,8 @@ static int add_memory_block(unsigned lon
+ if (ret)
+ return ret;
+
++ mem->altmap = altmap;
++
+ if (group) {
+ mem->group = group;
+ list_add(&mem->group_next, &group->memory_blocks);
--- /dev/null
+From stable+bounces-268622-greg=kroah.com@vger.kernel.org Thu Jun 25 18:26:27 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 12:25:07 -0400
+Subject: Input: include export.h in modules using EXPORT_SYMBOL*()
+To: stable@vger.kernel.org
+Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625162508.2501015-1-sashal@kernel.org>
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit df595059d54383c42607b59f1f9ea74dade280fe ]
+
+A number of modules in the input subsystem use EXPORT_SYMBOL() and
+friends without explicitly including the corresponding header
+<linux/export.h>. While the build currently succeeds due to this header
+being pulled in transitively, this is not guaranteed to be the case in
+the future.
+
+Let's add the explicit include to make the dependencies clear and
+prevent future build breakage.
+
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Stable-dep-of: 0adb483fbf2d ("Input: rmi4 - refactor register descriptor parsing")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/ff-core.c | 2 +-
+ drivers/input/ff-memless.c | 1 +
+ drivers/input/gameport/gameport.c | 1 +
+ drivers/input/input-poller.c | 1 +
+ drivers/input/input.c | 1 +
+ drivers/input/joystick/iforce/iforce-main.c | 1 +
+ drivers/input/joystick/iforce/iforce-packets.c | 1 +
+ drivers/input/misc/ad714x.c | 1 +
+ drivers/input/misc/adxl34x.c | 1 +
+ drivers/input/misc/cma3000_d0x.c | 1 +
+ drivers/input/rmi4/rmi_2d_sensor.c | 1 +
+ drivers/input/rmi4/rmi_bus.c | 1 +
+ drivers/input/rmi4/rmi_driver.c | 1 +
+ drivers/input/serio/hil_mlc.c | 1 +
+ drivers/input/serio/hp_sdc.c | 1 +
+ drivers/input/serio/i8042.c | 1 +
+ drivers/input/serio/libps2.c | 1 +
+ drivers/input/serio/serio.c | 1 +
+ drivers/input/sparse-keymap.c | 1 +
+ drivers/input/touchscreen.c | 1 +
+ drivers/input/touchscreen/ad7879.c | 1 +
+ drivers/input/touchscreen/cyttsp_core.c | 1 +
+ drivers/input/touchscreen/goodix_berlin_core.c | 1 +
+ drivers/input/touchscreen/tsc200x-core.c | 1 +
+ drivers/input/touchscreen/wm9705.c | 1 +
+ drivers/input/touchscreen/wm9712.c | 1 +
+ drivers/input/touchscreen/wm9713.c | 1 +
+ drivers/input/touchscreen/wm97xx-core.c | 1 +
+ 28 files changed, 28 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/ff-core.c
++++ b/drivers/input/ff-core.c
+@@ -8,9 +8,9 @@
+
+ /* #define DEBUG */
+
++#include <linux/export.h>
+ #include <linux/input.h>
+ #include <linux/limits.h>
+-#include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/overflow.h>
+ #include <linux/sched.h>
+--- a/drivers/input/ff-memless.c
++++ b/drivers/input/ff-memless.c
+@@ -10,6 +10,7 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <linux/export.h>
+ #include <linux/slab.h>
+ #include <linux/input.h>
+ #include <linux/module.h>
+--- a/drivers/input/gameport/gameport.c
++++ b/drivers/input/gameport/gameport.c
+@@ -9,6 +9,7 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <linux/export.h>
+ #include <linux/stddef.h>
+ #include <linux/module.h>
+ #include <linux/io.h>
+--- a/drivers/input/input-poller.c
++++ b/drivers/input/input-poller.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <linux/device.h>
++#include <linux/export.h>
+ #include <linux/input.h>
+ #include <linux/jiffies.h>
+ #include <linux/mutex.h>
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -8,6 +8,7 @@
+
+ #define pr_fmt(fmt) KBUILD_BASENAME ": " fmt
+
++#include <linux/export.h>
+ #include <linux/init.h>
+ #include <linux/types.h>
+ #include <linux/idr.h>
+--- a/drivers/input/joystick/iforce/iforce-main.c
++++ b/drivers/input/joystick/iforce/iforce-main.c
+@@ -6,6 +6,7 @@
+ * USB/RS232 I-Force joysticks and wheels.
+ */
+
++#include <linux/export.h>
+ #include <linux/unaligned.h>
+ #include "iforce.h"
+
+--- a/drivers/input/joystick/iforce/iforce-packets.c
++++ b/drivers/input/joystick/iforce/iforce-packets.c
+@@ -6,6 +6,7 @@
+ * USB/RS232 I-Force joysticks and wheels.
+ */
+
++#include <linux/export.h>
+ #include <linux/unaligned.h>
+ #include "iforce.h"
+
+--- a/drivers/input/misc/ad714x.c
++++ b/drivers/input/misc/ad714x.c
+@@ -6,6 +6,7 @@
+ */
+
+ #include <linux/device.h>
++#include <linux/export.h>
+ #include <linux/input.h>
+ #include <linux/interrupt.h>
+ #include <linux/slab.h>
+--- a/drivers/input/misc/adxl34x.c
++++ b/drivers/input/misc/adxl34x.c
+@@ -9,6 +9,7 @@
+
+ #include <linux/device.h>
+ #include <linux/delay.h>
++#include <linux/export.h>
+ #include <linux/input.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+--- a/drivers/input/misc/cma3000_d0x.c
++++ b/drivers/input/misc/cma3000_d0x.c
+@@ -6,6 +6,7 @@
+ * Author: Hemanth V <hemanthv@ti.com>
+ */
+
++#include <linux/export.h>
+ #include <linux/types.h>
+ #include <linux/interrupt.h>
+ #include <linux/delay.h>
+--- a/drivers/input/rmi4/rmi_2d_sensor.c
++++ b/drivers/input/rmi4/rmi_2d_sensor.c
+@@ -4,6 +4,7 @@
+ * Copyright (c) 2011 Unixphere
+ */
+
++#include <linux/export.h>
+ #include <linux/kernel.h>
+ #include <linux/device.h>
+ #include <linux/of.h>
+--- a/drivers/input/rmi4/rmi_bus.c
++++ b/drivers/input/rmi4/rmi_bus.c
+@@ -4,6 +4,7 @@
+ * Copyright (c) 2011 Unixphere
+ */
+
++#include <linux/export.h>
+ #include <linux/kernel.h>
+ #include <linux/device.h>
+ #include <linux/irq.h>
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -21,6 +21,7 @@
+ #include <linux/irqdomain.h>
+ #include <uapi/linux/input.h>
+ #include <linux/rmi.h>
++#include <linux/export.h>
+ #include "rmi_bus.h"
+ #include "rmi_driver.h"
+
+--- a/drivers/input/serio/hil_mlc.c
++++ b/drivers/input/serio/hil_mlc.c
+@@ -54,6 +54,7 @@
+
+ #include <linux/hil_mlc.h>
+ #include <linux/errno.h>
++#include <linux/export.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -63,6 +63,7 @@
+
+ #include <linux/hp_sdc.h>
+ #include <linux/errno.h>
++#include <linux/export.h>
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/ioport.h>
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -10,6 +10,7 @@
+
+ #include <linux/types.h>
+ #include <linux/delay.h>
++#include <linux/export.h>
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
+ #include <linux/ioport.h>
+--- a/drivers/input/serio/libps2.c
++++ b/drivers/input/serio/libps2.c
+@@ -8,6 +8,7 @@
+
+
+ #include <linux/delay.h>
++#include <linux/export.h>
+ #include <linux/module.h>
+ #include <linux/sched.h>
+ #include <linux/interrupt.h>
+--- a/drivers/input/serio/serio.c
++++ b/drivers/input/serio/serio.c
+@@ -9,6 +9,7 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <linux/export.h>
+ #include <linux/stddef.h>
+ #include <linux/module.h>
+ #include <linux/serio.h>
+--- a/drivers/input/sparse-keymap.c
++++ b/drivers/input/sparse-keymap.c
+@@ -10,6 +10,7 @@
+ * Copyright (C) 2005 Dmitry Torokhov <dtor@mail.ru>
+ */
+
++#include <linux/export.h>
+ #include <linux/input.h>
+ #include <linux/input/sparse-keymap.h>
+ #include <linux/module.h>
+--- a/drivers/input/touchscreen.c
++++ b/drivers/input/touchscreen.c
+@@ -6,6 +6,7 @@
+ * Copyright (c) 2014 Sebastian Reichel <sre@kernel.org>
+ */
+
++#include <linux/export.h>
+ #include <linux/property.h>
+ #include <linux/input.h>
+ #include <linux/input/mt.h>
+--- a/drivers/input/touchscreen/ad7879.c
++++ b/drivers/input/touchscreen/ad7879.c
+@@ -22,6 +22,7 @@
+
+ #include <linux/device.h>
+ #include <linux/delay.h>
++#include <linux/export.h>
+ #include <linux/input.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+--- a/drivers/input/touchscreen/cyttsp_core.c
++++ b/drivers/input/touchscreen/cyttsp_core.c
+@@ -14,6 +14,7 @@
+ */
+
+ #include <linux/delay.h>
++#include <linux/export.h>
+ #include <linux/input.h>
+ #include <linux/input/mt.h>
+ #include <linux/input/touchscreen.h>
+--- a/drivers/input/touchscreen/goodix_berlin_core.c
++++ b/drivers/input/touchscreen/goodix_berlin_core.c
+@@ -24,6 +24,7 @@
+ */
+
+ #include <linux/bitfield.h>
++#include <linux/export.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/input.h>
+ #include <linux/input/mt.h>
+--- a/drivers/input/touchscreen/tsc200x-core.c
++++ b/drivers/input/touchscreen/tsc200x-core.c
+@@ -10,6 +10,7 @@
+ * based on TSC2301 driver by Klaus K. Pedersen <klaus.k.pedersen@nokia.com>
+ */
+
++#include <linux/export.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/input.h>
+--- a/drivers/input/touchscreen/wm9705.c
++++ b/drivers/input/touchscreen/wm9705.c
+@@ -9,6 +9,7 @@
+ * Russell King <rmk@arm.linux.org.uk>
+ */
+
++#include <linux/export.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+ #include <linux/kernel.h>
+--- a/drivers/input/touchscreen/wm9712.c
++++ b/drivers/input/touchscreen/wm9712.c
+@@ -9,6 +9,7 @@
+ * Russell King <rmk@arm.linux.org.uk>
+ */
+
++#include <linux/export.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+ #include <linux/kernel.h>
+--- a/drivers/input/touchscreen/wm9713.c
++++ b/drivers/input/touchscreen/wm9713.c
+@@ -9,6 +9,7 @@
+ * Russell King <rmk@arm.linux.org.uk>
+ */
+
++#include <linux/export.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+ #include <linux/kernel.h>
+--- a/drivers/input/touchscreen/wm97xx-core.c
++++ b/drivers/input/touchscreen/wm97xx-core.c
+@@ -29,6 +29,7 @@
+ * - Support for async sampling control for noisy LCDs.
+ */
+
++#include <linux/export.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+ #include <linux/kernel.h>
--- /dev/null
+From sashal@kernel.org Thu Jun 25 18:25:12 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 12:25:08 -0400
+Subject: Input: rmi4 - refactor register descriptor parsing
+To: stable@vger.kernel.org
+Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625162508.2501015-2-sashal@kernel.org>
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 0adb483fbf2dc43c875cd7550a58b41e92efc52d ]
+
+Factor out parsing a register descriptor item from
+rmi_read_register_desc() and ensure there are no out-of-bounds accesses.
+
+Use get_unaligned_le16() and get_unaligned_le32() for reading multi-byte
+values.
+
+Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
+Cc: stable@vger.kernel.org
+Assisted-by: Gemini:gemini-3.1-pro
+Link: https://patch.msgid.link/20260505045952.1570713-2-dmitry.torokhov@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/rmi4/rmi_driver.c | 124 ++++++++++++++++++++++++----------------
+ 1 file changed, 76 insertions(+), 48 deletions(-)
+
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -22,6 +22,7 @@
+ #include <uapi/linux/input.h>
+ #include <linux/rmi.h>
+ #include <linux/export.h>
++#include <linux/unaligned.h>
+ #include "rmi_bus.h"
+ #include "rmi_driver.h"
+
+@@ -558,30 +559,74 @@ int rmi_scan_pdt(struct rmi_device *rmi_
+ return retval < 0 ? retval : 0;
+ }
+
++static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item,
++ const u8 *buf, size_t size)
++{
++ unsigned int offset = 0;
++ unsigned int map_offset = 0;
++ int b;
++
++ if (offset >= size)
++ return -EIO;
++
++ item->reg_size = buf[offset++];
++ if (item->reg_size == 0) {
++ if (size - offset < 2)
++ return -EIO;
++ item->reg_size = get_unaligned_le16(&buf[offset]);
++ offset += 2;
++ }
++
++ if (item->reg_size == 0) {
++ if (size - offset < 4)
++ return -EIO;
++ item->reg_size = get_unaligned_le32(&buf[offset]);
++ offset += 4;
++ }
++
++ do {
++ if (offset >= size)
++ return -EIO;
++
++ for (b = 0; b < 7; b++) {
++ if (buf[offset] & BIT(b)) {
++ if (map_offset >= RMI_REG_DESC_SUBPACKET_BITS)
++ return -EIO;
++ __set_bit(map_offset, item->subpacket_map);
++ }
++ ++map_offset;
++ }
++ } while (buf[offset++] & BIT(7));
++
++ item->num_subpackets = bitmap_weight(item->subpacket_map,
++ RMI_REG_DESC_SUBPACKET_BITS);
++
++ return offset;
++}
++
+ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
+- struct rmi_register_descriptor *rdesc)
++ struct rmi_register_descriptor *rdesc)
+ {
+ int ret;
+ u8 size_presence_reg;
+ u8 buf[35];
+- int presense_offset = 1;
+- u8 *struct_buf;
+- int reg;
+- int offset = 0;
+- int map_offset = 0;
++ unsigned int presence_offset;
++ unsigned int map_offset;
++ unsigned int offset;
++ unsigned int reg;
+ int i;
+ int b;
+
+ /*
+ * The first register of the register descriptor is the size of
+- * the register descriptor's presense register.
++ * the register descriptor's presence register.
+ */
+ ret = rmi_read(d, addr, &size_presence_reg);
+ if (ret)
+ return ret;
+ ++addr;
+
+- if (size_presence_reg < 0 || size_presence_reg > 35)
++ if (size_presence_reg < 1 || size_presence_reg > 35)
+ return -EIO;
+
+ memset(buf, 0, sizeof(buf));
+@@ -597,16 +642,23 @@ int rmi_read_register_desc(struct rmi_de
+ ++addr;
+
+ if (buf[0] == 0) {
+- presense_offset = 3;
+- rdesc->struct_size = buf[1] | (buf[2] << 8);
++ if (size_presence_reg < 3)
++ return -EIO;
++ presence_offset = 3;
++ rdesc->struct_size = get_unaligned_le16(&buf[1]);
+ } else {
++ presence_offset = 1;
+ rdesc->struct_size = buf[0];
+ }
+
+- for (i = presense_offset; i < size_presence_reg; i++) {
++ map_offset = 0;
++ for (i = presence_offset; i < size_presence_reg; i++) {
+ for (b = 0; b < 8; b++) {
+- if (buf[i] & (0x1 << b))
++ if (buf[i] & BIT(b)) {
++ if (map_offset >= RMI_REG_DESC_PRESENSE_BITS)
++ return -EIO;
+ bitmap_set(rdesc->presense_map, map_offset, 1);
++ }
+ ++map_offset;
+ }
+ }
+@@ -626,7 +678,7 @@ int rmi_read_register_desc(struct rmi_de
+ * I'm not using devm_kzalloc here since it will not be retained
+ * after exiting this function
+ */
+- struct_buf = kzalloc(rdesc->struct_size, GFP_KERNEL);
++ u8 *struct_buf __free(kfree) = kzalloc(rdesc->struct_size, GFP_KERNEL);
+ if (!struct_buf)
+ return -ENOMEM;
+
+@@ -638,56 +690,32 @@ int rmi_read_register_desc(struct rmi_de
+ */
+ ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size);
+ if (ret)
+- goto free_struct_buff;
++ return ret;
+
+ reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
++ offset = 0;
+ for (i = 0; i < rdesc->num_registers; i++) {
+ struct rmi_register_desc_item *item = &rdesc->registers[i];
+- int reg_size = struct_buf[offset];
++ int item_size;
+
+- ++offset;
+- if (reg_size == 0) {
+- reg_size = struct_buf[offset] |
+- (struct_buf[offset + 1] << 8);
+- offset += 2;
+- }
+-
+- if (reg_size == 0) {
+- reg_size = struct_buf[offset] |
+- (struct_buf[offset + 1] << 8) |
+- (struct_buf[offset + 2] << 16) |
+- (struct_buf[offset + 3] << 24);
+- offset += 4;
+- }
++ item_size = rmi_parse_register_desc_item(item,
++ &struct_buf[offset],
++ rdesc->struct_size - offset);
++ if (item_size < 0)
++ return item_size;
+
+ item->reg = reg;
+- item->reg_size = reg_size;
+-
+- map_offset = 0;
+-
+- do {
+- for (b = 0; b < 7; b++) {
+- if (struct_buf[offset] & (0x1 << b))
+- bitmap_set(item->subpacket_map,
+- map_offset, 1);
+- ++map_offset;
+- }
+- } while (struct_buf[offset++] & 0x80);
+-
+- item->num_subpackets = bitmap_weight(item->subpacket_map,
+- RMI_REG_DESC_SUBPACKET_BITS);
++ offset += item_size;
+
+ rmi_dbg(RMI_DEBUG_CORE, &d->dev,
+ "%s: reg: %d reg size: %ld subpackets: %d\n", __func__,
+ item->reg, item->reg_size, item->num_subpackets);
+
+ reg = find_next_bit(rdesc->presense_map,
+- RMI_REG_DESC_PRESENSE_BITS, reg + 1);
++ RMI_REG_DESC_PRESENSE_BITS, reg + 1);
+ }
+
+-free_struct_buff:
+- kfree(struct_buf);
+- return ret;
++ return 0;
+ }
+
+ const struct rmi_register_desc_item *rmi_get_register_desc_item(
--- /dev/null
+From stable+bounces-268551-greg=kroah.com@vger.kernel.org Thu Jun 25 15:49:56 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2026 09:49:39 -0400
+Subject: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
+To: stable@vger.kernel.org
+Cc: Stepan Ionichev <sozdayvek@gmail.com>, Andy Shevchenko <andriy.shevchenko@linux.intel.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260625134939.2415321-1-sashal@kernel.org>
+
+From: Stepan Ionichev <sozdayvek@gmail.com>
+
+[ Upstream commit 10fc708b4de7f86002d2d735a2dbf3b5b7f65692 ]
+
+dw8250_probe() registers the 8250 port via serial8250_register_8250_port()
+and then, if the device has a clock, registers a clock notifier. If
+clk_notifier_register() fails, probe returns the error but leaves the
+8250 port registered. The matching serial8250_unregister_port() lives
+in dw8250_remove(), which is not called when probe fails, so the port
+slot stays occupied until the device is rebound or the system is
+rebooted. The devm-allocated driver data is freed while the port still
+references it (via the saved private_data and serial_in/serial_out
+callbacks), so any access to that port slot before a rebind is a
+use-after-free hazard.
+
+Unregister the port on the clk_notifier_register() error path.
+
+Fixes: cc816969d7b5 ("serial: 8250_dw: Fix common clocks usage race condition")
+Cc: stable@vger.kernel.org
+Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20260514143746.23671-2-sozdayvek@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -655,8 +655,10 @@ static int dw8250_probe(struct platform_
+ */
+ if (data->clk) {
+ err = clk_notifier_register(data->clk, &data->clk_notifier);
+- if (err)
++ if (err) {
++ serial8250_unregister_port(data->data.line);
+ return dev_err_probe(dev, err, "Failed to set the clock notifier\n");
++ }
+ queue_work(system_unbound_wq, &data->clk_work);
+ }
+
nfsv4-pnfs-reject-zero-length-r_addr-in-nfs4_decode_mp_ds_addr.patch
nfs-prevent-resource-leak-in-nfs_alloc_server.patch
ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch
+serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch
+drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch
+documentation-ioctl-number-fix-linuxppc-dev-mailto-link.patch
+documentation-ioctl-number-extend-include-file-column-width.patch
+crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch
+crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch
+crypto-qat-remove-unused-character-device-and-ioctls.patch
+input-include-export.h-in-modules-using-export_symbol.patch
+input-rmi4-refactor-register-descriptor-parsing.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
