From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 14:16:49 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.10.260~24 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1938fd4b2e0789adc3c4d0c91a3c730b6a98239e;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: crypto-qat-remove-unused-character-device-and-ioctls.patch crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch documentation-ioctl-number-extend-include-file-column-width.patch drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch serial-qcom_geni-fix-rx-dma-stall-when-se_dma_rx_len_in-is-zero.patch --- diff --git a/queue-6.6/crypto-qat-remove-unused-character-device-and-ioctls.patch b/queue-6.6/crypto-qat-remove-unused-character-device-and-ioctls.patch new file mode 100644 index 0000000000..1ee1b404fb --- /dev/null +++ b/queue-6.6/crypto-qat-remove-unused-character-device-and-ioctls.patch @@ -0,0 +1,697 @@ +From stable+bounces-268621-greg=kroah.com@vger.kernel.org Thu Jun 25 18:25:11 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 12:25:01 -0400 +Subject: crypto: qat - remove unused character device and IOCTLs +To: stable@vger.kernel.org +Cc: Giovanni Cabiddu , Zhi Wang , Bin Yu , MingYu Wang , Ahsan Atta , Herbert Xu , Sasha Levin +Message-ID: <20260625162501.2500811-4-sashal@kernel.org> + +From: Giovanni Cabiddu + +[ Upstream commit d237230728c567297f2f98b425d63156ab2ed17f ] + +The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs +for device configuration, start, stop, status query and enumeration. +These IOCTLs are not part of any public uAPI header and have no known +in-tree or out-of-tree users. Device lifecycle is already managed via +sysfs. + +The ioctl interface also increases the attack surface and is the +subject of a number of bug reports. + +Remove the character device, the IOCTL definitions, and the related +data structures (adf_dev_status_info, adf_user_cfg_key_val, +adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused +adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal +module_init/module_exit hooks for workqueue, AER, and crypto/compression +algorithm registration. + +Clean up leftover dead code that was only reachable from the removed +IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), +adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), +adf_get_vf_real_id() and the unused ADF_CFG macros. + +Additionally, drop the entry associated to QAT IOCTLs in +ioctl-number.rst. + +Cc: stable@vger.kernel.org +Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") +Reported-by: Zhi Wang +Reported-by: Bin Yu +Reported-by: MingYu Wang +Closes: https://lore.kernel.org/all/61d6d499.ab89.19b9b7f3186.Coremail.wangzhi_xd@stu.xidian.edu.cn/ +Link: https://lore.kernel.org/all/20260508034841.256794-1-w15303746062@163.com/ +Link: https://lore.kernel.org/all/20260508023542.256299-1-w15303746062@163.com/ +Link: https://lore.kernel.org/all/20260504025120.98242-1-w15303746062@163.com/ +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Ahsan Atta +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/userspace-api/ioctl/ioctl-number.rst | 1 + drivers/crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - + drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - + drivers/crypto/intel/qat/qat_common/adf_common_drv.h | 3 + drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 401 ------------------- + drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 --- + 6 files changed, 1 insertion(+), 544 deletions(-) + delete mode 100644 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h + +--- a/Documentation/userspace-api/ioctl/ioctl-number.rst ++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst +@@ -219,7 +219,6 @@ Code Seq# Include File + + 'a' all linux/atm*.h, linux/sonet.h ATM on linux + +-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver + 'b' 00-FF conflict! bit3 vme host bridge + + 'b' 00-0F linux/dma-buf.h conflict! +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h ++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h +@@ -4,18 +4,11 @@ + #define ADF_CFG_COMMON_H_ + + #include +-#include + + #define ADF_CFG_MAX_STR_LEN 64 + #define ADF_CFG_MAX_KEY_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN + #define ADF_CFG_MAX_VAL_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN + #define ADF_CFG_MAX_SECTION_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN +-#define ADF_CFG_BASE_DEC 10 +-#define ADF_CFG_BASE_HEX 16 +-#define ADF_CFG_ALL_DEVICES 0xFE +-#define ADF_CFG_NO_DEVICE 0xFF +-#define ADF_CFG_AFFINITY_WHATEVER 0xFF +-#define MAX_DEVICE_NAME_SIZE 32 + #define ADF_MAX_DEVICES (32 * 32) + #define ADF_DEVS_ARRAY_SIZE BITS_TO_LONGS(ADF_MAX_DEVICES) + +@@ -48,29 +41,4 @@ enum adf_device_type { + DEV_C3XXXVF, + DEV_4XXX, + }; +- +-struct adf_dev_status_info { +- enum adf_device_type type; +- __u32 accel_id; +- __u32 instance_id; +- __u8 num_ae; +- __u8 num_accel; +- __u8 num_logical_accel; +- __u8 banks_per_accel; +- __u8 state; +- __u8 bus; +- __u8 dev; +- __u8 fun; +- char name[MAX_DEVICE_NAME_SIZE]; +-}; +- +-#define ADF_CTL_IOC_MAGIC 'a' +-#define IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS _IOW(ADF_CTL_IOC_MAGIC, 0, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_STOP_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 1, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_START_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 2, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_STATUS_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 3, __u32) +-#define IOCTL_GET_NUM_DEVICES _IOW(ADF_CTL_IOC_MAGIC, 4, __s32) + #endif +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_user.h ++++ /dev/null +@@ -1,38 +0,0 @@ +-/* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) */ +-/* Copyright(c) 2014 - 2020 Intel Corporation */ +-#ifndef ADF_CFG_USER_H_ +-#define ADF_CFG_USER_H_ +- +-#include "adf_cfg_common.h" +-#include "adf_cfg_strings.h" +- +-struct adf_user_cfg_key_val { +- char key[ADF_CFG_MAX_KEY_LEN_IN_BYTES]; +- char val[ADF_CFG_MAX_VAL_LEN_IN_BYTES]; +- union { +- struct adf_user_cfg_key_val *next; +- __u64 padding3; +- }; +- enum adf_cfg_val_type type; +-} __packed; +- +-struct adf_user_cfg_section { +- char name[ADF_CFG_MAX_SECTION_LEN_IN_BYTES]; +- union { +- struct adf_user_cfg_key_val *params; +- __u64 padding1; +- }; +- union { +- struct adf_user_cfg_section *next; +- __u64 padding3; +- }; +-} __packed; +- +-struct adf_user_cfg_ctl_data { +- union { +- struct adf_user_cfg_section *config_section; +- __u64 padding; +- }; +- __u8 device_id; +-} __packed; +-#endif +--- a/drivers/crypto/intel/qat/qat_common/adf_common_drv.h ++++ b/drivers/crypto/intel/qat/qat_common/adf_common_drv.h +@@ -65,11 +65,8 @@ int adf_devmgr_add_dev(struct adf_accel_ + void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev, + struct adf_accel_dev *pf); + struct list_head *adf_devmgr_get_head(void); +-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id); + struct adf_accel_dev *adf_devmgr_get_first(void); + struct adf_accel_dev *adf_devmgr_pci_to_accel_dev(struct pci_dev *pci_dev); +-int adf_devmgr_verify_id(u32 id); +-void adf_devmgr_get_num_dev(u32 *num); + int adf_devmgr_in_reset(struct adf_accel_dev *accel_dev); + int adf_dev_started(struct adf_accel_dev *accel_dev); + int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev); +--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c +@@ -2,407 +2,13 @@ + /* Copyright(c) 2014 - 2020 Intel Corporation */ + + #include ++#include + #include +-#include +-#include +-#include +-#include +-#include +-#include +-#include + +-#include "adf_accel_devices.h" + #include "adf_common_drv.h" +-#include "adf_cfg.h" +-#include "adf_cfg_common.h" +-#include "adf_cfg_user.h" +- +-#define ADF_CFG_MAX_SECTION 512 +-#define ADF_CFG_MAX_KEY_VAL 256 +- +-#define DEVICE_NAME "qat_adf_ctl" +- +-static DEFINE_MUTEX(adf_ctl_lock); +-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg); +- +-static const struct file_operations adf_ctl_ops = { +- .owner = THIS_MODULE, +- .unlocked_ioctl = adf_ctl_ioctl, +- .compat_ioctl = compat_ptr_ioctl, +-}; +- +-struct adf_ctl_drv_info { +- unsigned int major; +- struct cdev drv_cdev; +- struct class *drv_class; +-}; +- +-static struct adf_ctl_drv_info adf_ctl_drv; +- +-static void adf_chr_drv_destroy(void) +-{ +- device_destroy(adf_ctl_drv.drv_class, MKDEV(adf_ctl_drv.major, 0)); +- cdev_del(&adf_ctl_drv.drv_cdev); +- class_destroy(adf_ctl_drv.drv_class); +- unregister_chrdev_region(MKDEV(adf_ctl_drv.major, 0), 1); +-} +- +-static int adf_chr_drv_create(void) +-{ +- dev_t dev_id; +- struct device *drv_device; +- +- if (alloc_chrdev_region(&dev_id, 0, 1, DEVICE_NAME)) { +- pr_err("QAT: unable to allocate chrdev region\n"); +- return -EFAULT; +- } +- +- adf_ctl_drv.drv_class = class_create(DEVICE_NAME); +- if (IS_ERR(adf_ctl_drv.drv_class)) { +- pr_err("QAT: class_create failed for adf_ctl\n"); +- goto err_chrdev_unreg; +- } +- adf_ctl_drv.major = MAJOR(dev_id); +- cdev_init(&adf_ctl_drv.drv_cdev, &adf_ctl_ops); +- if (cdev_add(&adf_ctl_drv.drv_cdev, dev_id, 1)) { +- pr_err("QAT: cdev add failed\n"); +- goto err_class_destr; +- } +- +- drv_device = device_create(adf_ctl_drv.drv_class, NULL, +- MKDEV(adf_ctl_drv.major, 0), +- NULL, DEVICE_NAME); +- if (IS_ERR(drv_device)) { +- pr_err("QAT: failed to create device\n"); +- goto err_cdev_del; +- } +- return 0; +-err_cdev_del: +- cdev_del(&adf_ctl_drv.drv_cdev); +-err_class_destr: +- class_destroy(adf_ctl_drv.drv_class); +-err_chrdev_unreg: +- unregister_chrdev_region(dev_id, 1); +- return -EFAULT; +-} +- +-static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg) +-{ +- struct adf_user_cfg_ctl_data *cfg_data; +- +- cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); +- if (IS_ERR(cfg_data)) +- pr_err("QAT: failed to copy from user cfg_data.\n"); +- return cfg_data; +-} +- +-static int adf_add_key_value_data(struct adf_accel_dev *accel_dev, +- const char *section, +- const struct adf_user_cfg_key_val *key_val) +-{ +- if (key_val->type == ADF_HEX) { +- long *ptr = (long *)key_val->val; +- long val = *ptr; +- +- if (adf_cfg_add_key_value_param(accel_dev, section, +- key_val->key, (void *)val, +- key_val->type)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add hex keyvalue.\n"); +- return -EFAULT; +- } +- } else { +- if (adf_cfg_add_key_value_param(accel_dev, section, +- key_val->key, key_val->val, +- key_val->type)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add keyvalue.\n"); +- return -EFAULT; +- } +- } +- return 0; +-} +- +-static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev, +- struct adf_user_cfg_ctl_data *ctl_data) +-{ +- struct adf_user_cfg_key_val key_val; +- struct adf_user_cfg_key_val *params_head; +- struct adf_user_cfg_section section, *section_head; +- int i, j; +- +- section_head = ctl_data->config_section; +- +- for (i = 0; section_head && i < ADF_CFG_MAX_SECTION; i++) { +- if (copy_from_user(§ion, (void __user *)section_head, +- sizeof(*section_head))) { +- dev_err(&GET_DEV(accel_dev), +- "failed to copy section info\n"); +- goto out_err; +- } +- +- if (adf_cfg_section_add(accel_dev, section.name)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add section.\n"); +- goto out_err; +- } +- +- params_head = section.params; +- +- for (j = 0; params_head && j < ADF_CFG_MAX_KEY_VAL; j++) { +- if (copy_from_user(&key_val, (void __user *)params_head, +- sizeof(key_val))) { +- dev_err(&GET_DEV(accel_dev), +- "Failed to copy keyvalue.\n"); +- goto out_err; +- } +- if (adf_add_key_value_data(accel_dev, section.name, +- &key_val)) { +- goto out_err; +- } +- params_head = key_val.next; +- } +- section_head = section.next; +- } +- return 0; +-out_err: +- adf_cfg_del_all(accel_dev); +- return -EFAULT; +-} +- +-static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- struct adf_user_cfg_ctl_data *ctl_data; +- struct adf_accel_dev *accel_dev; +- int ret = 0; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); +- if (!accel_dev) { +- ret = -EFAULT; +- goto out; +- } +- +- if (adf_dev_started(accel_dev)) { +- ret = -EFAULT; +- goto out; +- } +- +- if (adf_copy_key_value_data(accel_dev, ctl_data)) { +- ret = -EFAULT; +- goto out; +- } +- set_bit(ADF_STATUS_CONFIGURED, &accel_dev->status); +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_is_device_in_use(int id) +-{ +- struct adf_accel_dev *dev; +- +- list_for_each_entry(dev, adf_devmgr_get_head(), list) { +- if (id == dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (adf_devmgr_in_reset(dev) || adf_dev_in_use(dev)) { +- dev_info(&GET_DEV(dev), +- "device qat_dev%d is busy\n", +- dev->accel_id); +- return -EBUSY; +- } +- } +- } +- return 0; +-} +- +-static void adf_ctl_stop_devices(u32 id) +-{ +- struct adf_accel_dev *accel_dev; +- +- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) { +- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (!adf_dev_started(accel_dev)) +- continue; +- +- /* First stop all VFs */ +- if (!accel_dev->is_vf) +- continue; +- +- adf_dev_down(accel_dev, false); +- } +- } +- +- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) { +- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (!adf_dev_started(accel_dev)) +- continue; +- +- adf_dev_down(accel_dev, false); +- } +- } +-} +- +-static int adf_ctl_ioctl_dev_stop(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- int ret; +- struct adf_user_cfg_ctl_data *ctl_data; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- if (adf_devmgr_verify_id(ctl_data->device_id)) { +- pr_err("QAT: Device %d not found\n", ctl_data->device_id); +- ret = -ENODEV; +- goto out; +- } +- +- ret = adf_ctl_is_device_in_use(ctl_data->device_id); +- if (ret) +- goto out; +- +- if (ctl_data->device_id == ADF_CFG_ALL_DEVICES) +- pr_info("QAT: Stopping all acceleration devices.\n"); +- else +- pr_info("QAT: Stopping acceleration device qat_dev%d.\n", +- ctl_data->device_id); +- +- adf_ctl_stop_devices(ctl_data->device_id); +- +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_ioctl_dev_start(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- int ret; +- struct adf_user_cfg_ctl_data *ctl_data; +- struct adf_accel_dev *accel_dev; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- ret = -ENODEV; +- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); +- if (!accel_dev) +- goto out; +- +- dev_info(&GET_DEV(accel_dev), +- "Starting acceleration device qat_dev%d.\n", +- ctl_data->device_id); +- +- ret = adf_dev_up(accel_dev, false); +- +- if (ret) { +- dev_err(&GET_DEV(accel_dev), "Failed to start qat_dev%d\n", +- ctl_data->device_id); +- adf_dev_down(accel_dev, false); +- } +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_ioctl_get_num_devices(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- u32 num_devices = 0; +- +- adf_devmgr_get_num_dev(&num_devices); +- if (copy_to_user((void __user *)arg, &num_devices, sizeof(num_devices))) +- return -EFAULT; +- +- return 0; +-} +- +-static int adf_ctl_ioctl_get_status(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- struct adf_hw_device_data *hw_data; +- struct adf_dev_status_info dev_info; +- struct adf_accel_dev *accel_dev; +- +- if (copy_from_user(&dev_info, (void __user *)arg, +- sizeof(struct adf_dev_status_info))) { +- pr_err("QAT: failed to copy from user.\n"); +- return -EFAULT; +- } +- +- accel_dev = adf_devmgr_get_dev_by_id(dev_info.accel_id); +- if (!accel_dev) +- return -ENODEV; +- +- hw_data = accel_dev->hw_device; +- dev_info.state = adf_dev_started(accel_dev) ? DEV_UP : DEV_DOWN; +- dev_info.num_ae = hw_data->get_num_aes(hw_data); +- dev_info.num_accel = hw_data->get_num_accels(hw_data); +- dev_info.num_logical_accel = hw_data->num_logical_accel; +- dev_info.banks_per_accel = hw_data->num_banks +- / hw_data->num_logical_accel; +- strscpy(dev_info.name, hw_data->dev_class->name, sizeof(dev_info.name)); +- dev_info.instance_id = hw_data->instance_id; +- dev_info.type = hw_data->dev_class->type; +- dev_info.bus = accel_to_pci_dev(accel_dev)->bus->number; +- dev_info.dev = PCI_SLOT(accel_to_pci_dev(accel_dev)->devfn); +- dev_info.fun = PCI_FUNC(accel_to_pci_dev(accel_dev)->devfn); +- +- if (copy_to_user((void __user *)arg, &dev_info, +- sizeof(struct adf_dev_status_info))) { +- dev_err(&GET_DEV(accel_dev), "failed to copy status.\n"); +- return -EFAULT; +- } +- return 0; +-} +- +-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) +-{ +- int ret; +- +- if (mutex_lock_interruptible(&adf_ctl_lock)) +- return -EFAULT; +- +- switch (cmd) { +- case IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS: +- ret = adf_ctl_ioctl_dev_config(fp, cmd, arg); +- break; +- +- case IOCTL_STOP_ACCEL_DEV: +- ret = adf_ctl_ioctl_dev_stop(fp, cmd, arg); +- break; +- +- case IOCTL_START_ACCEL_DEV: +- ret = adf_ctl_ioctl_dev_start(fp, cmd, arg); +- break; +- +- case IOCTL_GET_NUM_DEVICES: +- ret = adf_ctl_ioctl_get_num_devices(fp, cmd, arg); +- break; +- +- case IOCTL_STATUS_ACCEL_DEV: +- ret = adf_ctl_ioctl_get_status(fp, cmd, arg); +- break; +- default: +- pr_err_ratelimited("QAT: Invalid ioctl %d\n", cmd); +- ret = -EFAULT; +- break; +- } +- mutex_unlock(&adf_ctl_lock); +- return ret; +-} + + static int __init adf_register_ctl_device_driver(void) + { +- if (adf_chr_drv_create()) +- goto err_chr_dev; +- + if (adf_init_misc_wq()) + goto err_misc_wq; + +@@ -434,15 +40,11 @@ err_pf_wq: + err_aer: + adf_exit_misc_wq(); + err_misc_wq: +- adf_chr_drv_destroy(); +-err_chr_dev: +- mutex_destroy(&adf_ctl_lock); + return -EFAULT; + } + + static void __exit adf_unregister_ctl_device_driver(void) + { +- adf_chr_drv_destroy(); + adf_exit_misc_wq(); + adf_exit_aer(); + adf_exit_vf_wq(); +@@ -450,7 +52,6 @@ static void __exit adf_unregister_ctl_de + qat_crypto_unregister(); + qat_compression_unregister(); + adf_clean_vf_map(false); +- mutex_destroy(&adf_ctl_lock); + } + + module_init(adf_register_ctl_device_driver); +--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c +@@ -45,19 +45,6 @@ static struct vf_id_map *adf_find_vf(u32 + return NULL; + } + +-static int adf_get_vf_real_id(u32 fake) +-{ +- struct list_head *itr; +- +- list_for_each(itr, &vfs_table) { +- struct vf_id_map *ptr = +- list_entry(itr, struct vf_id_map, list); +- if (ptr->fake_id == fake) +- return ptr->id; +- } +- return -1; +-} +- + /** + * adf_clean_vf_map() - Cleans VF id mapings + * +@@ -314,63 +301,6 @@ struct adf_accel_dev *adf_devmgr_pci_to_ + } + EXPORT_SYMBOL_GPL(adf_devmgr_pci_to_accel_dev); + +-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id) +-{ +- struct list_head *itr; +- int real_id; +- +- mutex_lock(&table_lock); +- real_id = adf_get_vf_real_id(id); +- if (real_id < 0) +- goto unlock; +- +- id = real_id; +- +- list_for_each(itr, &accel_table) { +- struct adf_accel_dev *ptr = +- list_entry(itr, struct adf_accel_dev, list); +- if (ptr->accel_id == id) { +- mutex_unlock(&table_lock); +- return ptr; +- } +- } +-unlock: +- mutex_unlock(&table_lock); +- return NULL; +-} +- +-int adf_devmgr_verify_id(u32 id) +-{ +- if (id == ADF_CFG_ALL_DEVICES) +- return 0; +- +- if (adf_devmgr_get_dev_by_id(id)) +- return 0; +- +- return -ENODEV; +-} +- +-static int adf_get_num_dettached_vfs(void) +-{ +- struct list_head *itr; +- int vfs = 0; +- +- mutex_lock(&table_lock); +- list_for_each(itr, &vfs_table) { +- struct vf_id_map *ptr = +- list_entry(itr, struct vf_id_map, list); +- if (ptr->bdf != ~0 && !ptr->attached) +- vfs++; +- } +- mutex_unlock(&table_lock); +- return vfs; +-} +- +-void adf_devmgr_get_num_dev(u32 *num) +-{ +- *num = num_devices - adf_get_num_dettached_vfs(); +-} +- + /** + * adf_dev_in_use() - Check whether accel_dev is currently in use + * @accel_dev: Pointer to acceleration device. diff --git a/queue-6.6/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch b/queue-6.6/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch new file mode 100644 index 0000000000..85b31d2a89 --- /dev/null +++ b/queue-6.6/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch @@ -0,0 +1,54 @@ +From stable+bounces-268618-greg=kroah.com@vger.kernel.org Thu Jun 25 18:25:09 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 12:24:59 -0400 +Subject: crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() +To: stable@vger.kernel.org +Cc: Thorsten Blum , Herbert Xu , Sasha Levin +Message-ID: <20260625162501.2500811-2-sashal@kernel.org> + +From: Thorsten Blum + +[ Upstream commit 1e26339703e2afd397037defa798682b2b93dcc0 ] + +Replace kzalloc() followed by copy_from_user() with memdup_user() to +improve and simplify adf_ctl_alloc_resources(). memdup_user() returns +either -ENOMEM or -EFAULT (instead of -EIO) if an error occurs. + +Remove the unnecessary device id initialization, since memdup_user() +(like copy_from_user()) immediately overwrites it. + +No functional changes intended other than returning the more idiomatic +error code -EFAULT. + +Signed-off-by: Thorsten Blum +Signed-off-by: Herbert Xu +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c +@@ -91,17 +91,10 @@ static int adf_ctl_alloc_resources(struc + { + struct adf_user_cfg_ctl_data *cfg_data; + +- cfg_data = kzalloc(sizeof(*cfg_data), GFP_KERNEL); +- if (!cfg_data) +- return -ENOMEM; +- +- /* Initialize device id to NO DEVICE as 0 is a valid device id */ +- cfg_data->device_id = ADF_CFG_NO_DEVICE; +- +- if (copy_from_user(cfg_data, (void __user *)arg, sizeof(*cfg_data))) { ++ cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); ++ if (IS_ERR(cfg_data)) { + pr_err("QAT: failed to copy from user cfg_data.\n"); +- kfree(cfg_data); +- return -EIO; ++ return PTR_ERR(cfg_data); + } + + *ctl_data = cfg_data; diff --git a/queue-6.6/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch b/queue-6.6/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch new file mode 100644 index 0000000000..919bbbd1ac --- /dev/null +++ b/queue-6.6/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch @@ -0,0 +1,123 @@ +From stable+bounces-268620-greg=kroah.com@vger.kernel.org Thu Jun 25 18:25:25 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 12:25:00 -0400 +Subject: crypto: qat - Return pointer directly in adf_ctl_alloc_resources +To: stable@vger.kernel.org +Cc: Herbert Xu , Thorsten Blum , Giovanni Cabiddu , Sasha Levin +Message-ID: <20260625162501.2500811-3-sashal@kernel.org> + +From: Herbert Xu + +[ Upstream commit 5ce9891ea928208a915411ce8227f8c3e37e5ad9 ] + +Returning values through arguments is confusing and that has +upset the compiler with the recent change to memdup_user: + +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:308:26: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 308 | ctl_data->device_id); + | ^~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:294:39: note: ‘ctl_data’ was declared here + 294 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ +In function ‘adf_ctl_ioctl_dev_stop’, + inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:386:9: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:273:48: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 273 | ret = adf_ctl_is_device_in_use(ctl_data->device_id); + | ~~~~~~~~^~~~~~~~~~~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:261:39: note: ‘ctl_data’ was declared here + 261 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ +In function ‘adf_ctl_ioctl_dev_config’, + inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:382:9: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:192:54: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 192 | accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); + | ~~~~~~~~^~~~~~~~~~~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:185:39: note: ‘ctl_data’ was declared here + 185 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ + +Fix this by returning the pointer directly. + +Signed-off-by: Herbert Xu +Reviewed-by: Thorsten Blum +Acked-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 31 +++++++++------------- + 1 file changed, 13 insertions(+), 18 deletions(-) + +--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c +@@ -86,19 +86,14 @@ err_chrdev_unreg: + return -EFAULT; + } + +-static int adf_ctl_alloc_resources(struct adf_user_cfg_ctl_data **ctl_data, +- unsigned long arg) ++static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg) + { + struct adf_user_cfg_ctl_data *cfg_data; + + cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); +- if (IS_ERR(cfg_data)) { ++ if (IS_ERR(cfg_data)) + pr_err("QAT: failed to copy from user cfg_data.\n"); +- return PTR_ERR(cfg_data); +- } +- +- *ctl_data = cfg_data; +- return 0; ++ return cfg_data; + } + + static int adf_add_key_value_data(struct adf_accel_dev *accel_dev, +@@ -178,13 +173,13 @@ out_err: + static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd, + unsigned long arg) + { +- int ret; + struct adf_user_cfg_ctl_data *ctl_data; + struct adf_accel_dev *accel_dev; ++ int ret = 0; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); + if (!accel_dev) { +@@ -257,9 +252,9 @@ static int adf_ctl_ioctl_dev_stop(struct + int ret; + struct adf_user_cfg_ctl_data *ctl_data; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + if (adf_devmgr_verify_id(ctl_data->device_id)) { + pr_err("QAT: Device %d not found\n", ctl_data->device_id); +@@ -291,9 +286,9 @@ static int adf_ctl_ioctl_dev_start(struc + struct adf_user_cfg_ctl_data *ctl_data; + struct adf_accel_dev *accel_dev; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + ret = -ENODEV; + accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); diff --git a/queue-6.6/documentation-ioctl-number-extend-include-file-column-width.patch b/queue-6.6/documentation-ioctl-number-extend-include-file-column-width.patch new file mode 100644 index 0000000000..2522736dcc --- /dev/null +++ b/queue-6.6/documentation-ioctl-number-extend-include-file-column-width.patch @@ -0,0 +1,579 @@ +From stable+bounces-268619-greg=kroah.com@vger.kernel.org Thu Jun 25 18:25:19 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 12:24:58 -0400 +Subject: Documentation: ioctl-number: Extend "Include File" column width +To: stable@vger.kernel.org +Cc: Bagas Sanjaya , Haren Myneni , Madhavan Srinivasan , Jonathan Corbet , Sasha Levin +Message-ID: <20260625162501.2500811-1-sashal@kernel.org> + +From: Bagas Sanjaya + +[ Upstream commit 15afd5def819e4df2a29cef6fcfa6ae7ba167c0f ] + +Extend width of "Include File" column to fit full path to +papr-physical-attestation.h in later commit. + +Reviewed-by: Haren Myneni +Signed-off-by: Bagas Sanjaya +Acked-by: Madhavan Srinivasan +Signed-off-by: Jonathan Corbet +Link: https://lore.kernel.org/r/20250714015711.14525-3-bagasdotme@gmail.com +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/userspace-api/ioctl/ioctl-number.rst | 464 ++++++++++----------- + 1 file changed, 232 insertions(+), 232 deletions(-) + +--- a/Documentation/userspace-api/ioctl/ioctl-number.rst ++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst +@@ -66,17 +66,17 @@ This table lists ioctls visible from use + most drivers up to 2.6.31, but I know I am missing some. There has been + no attempt to list non-X86 architectures or ioctls from drivers/staging/. + +-==== ===== ======================================================= ================================================================ +-Code Seq# Include File Comments ++==== ===== ========================================================= ================================================================ ++Code Seq# Include File Comments + (hex) +-==== ===== ======================================================= ================================================================ +-0x00 00-1F linux/fs.h conflict! +-0x00 00-1F scsi/scsi_ioctl.h conflict! +-0x00 00-1F linux/fb.h conflict! +-0x00 00-1F linux/wavefront.h conflict! ++==== ===== ========================================================= ================================================================ ++0x00 00-1F linux/fs.h conflict! ++0x00 00-1F scsi/scsi_ioctl.h conflict! ++0x00 00-1F linux/fb.h conflict! ++0x00 00-1F linux/wavefront.h conflict! + 0x02 all linux/fd.h + 0x03 all linux/hdreg.h +-0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these. ++0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these. + 0x06 all linux/lp.h + 0x09 all linux/raid/md_u.h + 0x10 00-0F drivers/char/s390/vmcp.h +@@ -84,299 +84,299 @@ Code Seq# Include File + 0x10 20-2F arch/s390/include/uapi/asm/hypfs.h + 0x12 all linux/fs.h + linux/blkpg.h +-0x1b all InfiniBand Subsystem +- ++0x1b all InfiniBand Subsystem ++ + 0x20 all drivers/cdrom/cm206.h + 0x22 all scsi/sg.h +-0x3E 00-0F linux/counter.h ++0x3E 00-0F linux/counter.h + '!' 00-1F uapi/linux/seccomp.h +-'#' 00-3F IEEE 1394 Subsystem +- Block for the entire subsystem ++'#' 00-3F IEEE 1394 Subsystem ++ Block for the entire subsystem + '$' 00-0F linux/perf_counter.h, linux/perf_event.h +-'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem +- ++'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem ++ + '&' 00-07 drivers/firewire/nosy-user.h +-'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl +- ++'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl ++ + '2' 01-04 linux/i2o.h +-'3' 00-0F drivers/s390/char/raw3270.h conflict! +-'3' 00-1F linux/suspend_ioctls.h, conflict! ++'3' 00-0F drivers/s390/char/raw3270.h conflict! ++'3' 00-1F linux/suspend_ioctls.h, conflict! + kernel/power/user.c +-'8' all SNP8023 advanced NIC card +- ++'8' all SNP8023 advanced NIC card ++ + ';' 64-7F linux/vfio.h + ';' 80-FF linux/iommufd.h +-'=' 00-3f uapi/linux/ptp_clock.h +-'@' 00-0F linux/radeonfb.h conflict! +-'@' 00-0F drivers/video/aty/aty128fb.c conflict! +-'A' 00-1F linux/apm_bios.h conflict! +-'A' 00-0F linux/agpgart.h, conflict! ++'=' 00-3f uapi/linux/ptp_clock.h ++'@' 00-0F linux/radeonfb.h conflict! ++'@' 00-0F drivers/video/aty/aty128fb.c conflict! ++'A' 00-1F linux/apm_bios.h conflict! ++'A' 00-0F linux/agpgart.h, conflict! + drivers/char/agp/compat_ioctl.h +-'A' 00-7F sound/asound.h conflict! +-'B' 00-1F linux/cciss_ioctl.h conflict! +-'B' 00-0F include/linux/pmu.h conflict! +-'B' C0-FF advanced bbus +-'B' 00-0F xen/xenbus_dev.h conflict! +-'C' all linux/soundcard.h conflict! +-'C' 01-2F linux/capi.h conflict! +-'C' F0-FF drivers/net/wan/cosa.h conflict! ++'A' 00-7F sound/asound.h conflict! ++'B' 00-1F linux/cciss_ioctl.h conflict! ++'B' 00-0F include/linux/pmu.h conflict! ++'B' C0-FF advanced bbus ++'B' 00-0F xen/xenbus_dev.h conflict! ++'C' all linux/soundcard.h conflict! ++'C' 01-2F linux/capi.h conflict! ++'C' F0-FF drivers/net/wan/cosa.h conflict! + 'D' all arch/s390/include/asm/dasd.h +-'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h Dead since 2022 ++'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h Dead since 2022 + 'D' 05 drivers/scsi/pmcraid.h +-'E' all linux/input.h conflict! +-'E' 00-0F xen/evtchn.h conflict! +-'F' all linux/fb.h conflict! +-'F' 01-02 drivers/scsi/pmcraid.h conflict! +-'F' 20 drivers/video/fsl-diu-fb.h conflict! +-'F' 20 drivers/video/intelfb/intelfb.h conflict! +-'F' 20 linux/ivtvfb.h conflict! +-'F' 20 linux/matroxfb.h conflict! +-'F' 20 drivers/video/aty/atyfb_base.c conflict! +-'F' 00-0F video/da8xx-fb.h conflict! +-'F' 80-8F linux/arcfb.h conflict! +-'F' DD video/sstfb.h conflict! +-'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict! +-'G' 00-0F xen/gntalloc.h, xen/gntdev.h conflict! +-'H' 00-7F linux/hiddev.h conflict! +-'H' 00-0F linux/hidraw.h conflict! +-'H' 01 linux/mei.h conflict! +-'H' 02 linux/mei.h conflict! +-'H' 03 linux/mei.h conflict! +-'H' 00-0F sound/asound.h conflict! +-'H' 20-40 sound/asound_fm.h conflict! +-'H' 80-8F sound/sfnt_info.h conflict! +-'H' 10-8F sound/emu10k1.h conflict! +-'H' 10-1F sound/sb16_csp.h conflict! +-'H' 10-1F sound/hda_hwdep.h conflict! +-'H' 40-4F sound/hdspm.h conflict! +-'H' 40-4F sound/hdsp.h conflict! ++'E' all linux/input.h conflict! ++'E' 00-0F xen/evtchn.h conflict! ++'F' all linux/fb.h conflict! ++'F' 01-02 drivers/scsi/pmcraid.h conflict! ++'F' 20 drivers/video/fsl-diu-fb.h conflict! ++'F' 20 drivers/video/intelfb/intelfb.h conflict! ++'F' 20 linux/ivtvfb.h conflict! ++'F' 20 linux/matroxfb.h conflict! ++'F' 20 drivers/video/aty/atyfb_base.c conflict! ++'F' 00-0F video/da8xx-fb.h conflict! ++'F' 80-8F linux/arcfb.h conflict! ++'F' DD video/sstfb.h conflict! ++'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict! ++'G' 00-0F xen/gntalloc.h, xen/gntdev.h conflict! ++'H' 00-7F linux/hiddev.h conflict! ++'H' 00-0F linux/hidraw.h conflict! ++'H' 01 linux/mei.h conflict! ++'H' 02 linux/mei.h conflict! ++'H' 03 linux/mei.h conflict! ++'H' 00-0F sound/asound.h conflict! ++'H' 20-40 sound/asound_fm.h conflict! ++'H' 80-8F sound/sfnt_info.h conflict! ++'H' 10-8F sound/emu10k1.h conflict! ++'H' 10-1F sound/sb16_csp.h conflict! ++'H' 10-1F sound/hda_hwdep.h conflict! ++'H' 40-4F sound/hdspm.h conflict! ++'H' 40-4F sound/hdsp.h conflict! + 'H' 90 sound/usb/usx2y/usb_stream.h +-'H' 00-0F uapi/misc/habanalabs.h conflict! ++'H' 00-0F uapi/misc/habanalabs.h conflict! + 'H' A0 uapi/linux/usb/cdc-wdm.h +-'H' C0-F0 net/bluetooth/hci.h conflict! +-'H' C0-DF net/bluetooth/hidp/hidp.h conflict! +-'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict! +-'H' C0-DF net/bluetooth/bnep/bnep.h conflict! +-'H' F1 linux/hid-roccat.h ++'H' C0-F0 net/bluetooth/hci.h conflict! ++'H' C0-DF net/bluetooth/hidp/hidp.h conflict! ++'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict! ++'H' C0-DF net/bluetooth/bnep/bnep.h conflict! ++'H' F1 linux/hid-roccat.h + 'H' F8-FA sound/firewire.h +-'I' all linux/isdn.h conflict! +-'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict! +-'I' 40-4F linux/mISDNif.h conflict! ++'I' all linux/isdn.h conflict! ++'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict! ++'I' 40-4F linux/mISDNif.h conflict! + 'K' all linux/kd.h +-'L' 00-1F linux/loop.h conflict! +-'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict! +-'L' E0-FF linux/ppdd.h encrypted disk device driver +- +-'M' all linux/soundcard.h conflict! +-'M' 01-16 mtd/mtd-abi.h conflict! ++'L' 00-1F linux/loop.h conflict! ++'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict! ++'L' E0-FF linux/ppdd.h encrypted disk device driver ++ ++'M' all linux/soundcard.h conflict! ++'M' 01-16 mtd/mtd-abi.h conflict! + and drivers/mtd/mtdchar.c + 'M' 01-03 drivers/scsi/megaraid/megaraid_sas.h +-'M' 00-0F drivers/video/fsl-diu-fb.h conflict! ++'M' 00-0F drivers/video/fsl-diu-fb.h conflict! + 'N' 00-1F drivers/usb/scanner.h + 'N' 40-7F drivers/block/nvme.c +-'O' 00-06 mtd/ubi-user.h UBI +-'P' all linux/soundcard.h conflict! +-'P' 60-6F sound/sscape_ioctl.h conflict! +-'P' 00-0F drivers/usb/class/usblp.c conflict! +-'P' 01-09 drivers/misc/pci_endpoint_test.c conflict! +-'P' 00-0F xen/privcmd.h conflict! +-'P' 00-05 linux/tps6594_pfsm.h conflict! ++'O' 00-06 mtd/ubi-user.h UBI ++'P' all linux/soundcard.h conflict! ++'P' 60-6F sound/sscape_ioctl.h conflict! ++'P' 00-0F drivers/usb/class/usblp.c conflict! ++'P' 01-09 drivers/misc/pci_endpoint_test.c conflict! ++'P' 00-0F xen/privcmd.h conflict! ++'P' 00-05 linux/tps6594_pfsm.h conflict! + 'Q' all linux/soundcard.h +-'R' 00-1F linux/random.h conflict! +-'R' 01 linux/rfkill.h conflict! ++'R' 00-1F linux/random.h conflict! ++'R' 01 linux/rfkill.h conflict! + 'R' C0-DF net/bluetooth/rfcomm.h + 'R' E0 uapi/linux/fsl_mc.h +-'S' all linux/cdrom.h conflict! +-'S' 80-81 scsi/scsi_ioctl.h conflict! +-'S' 82-FF scsi/scsi.h conflict! +-'S' 00-7F sound/asequencer.h conflict! +-'T' all linux/soundcard.h conflict! +-'T' 00-AF sound/asound.h conflict! +-'T' all arch/x86/include/asm/ioctls.h conflict! +-'T' C0-DF linux/if_tun.h conflict! +-'U' all sound/asound.h conflict! +-'U' 00-CF linux/uinput.h conflict! ++'S' all linux/cdrom.h conflict! ++'S' 80-81 scsi/scsi_ioctl.h conflict! ++'S' 82-FF scsi/scsi.h conflict! ++'S' 00-7F sound/asequencer.h conflict! ++'T' all linux/soundcard.h conflict! ++'T' 00-AF sound/asound.h conflict! ++'T' all arch/x86/include/asm/ioctls.h conflict! ++'T' C0-DF linux/if_tun.h conflict! ++'U' all sound/asound.h conflict! ++'U' 00-CF linux/uinput.h conflict! + 'U' 00-EF linux/usbdevice_fs.h + 'U' C0-CF drivers/bluetooth/hci_uart.h +-'V' all linux/vt.h conflict! +-'V' all linux/videodev2.h conflict! +-'V' C0 linux/ivtvfb.h conflict! +-'V' C0 linux/ivtv.h conflict! +-'V' C0 media/si4713.h conflict! +-'W' 00-1F linux/watchdog.h conflict! +-'W' 00-1F linux/wanrouter.h conflict! (pre 3.9) +-'W' 00-3F sound/asound.h conflict! ++'V' all linux/vt.h conflict! ++'V' all linux/videodev2.h conflict! ++'V' C0 linux/ivtvfb.h conflict! ++'V' C0 linux/ivtv.h conflict! ++'V' C0 media/si4713.h conflict! ++'W' 00-1F linux/watchdog.h conflict! ++'W' 00-1F linux/wanrouter.h conflict! (pre 3.9) ++'W' 00-3F sound/asound.h conflict! + 'W' 40-5F drivers/pci/switch/switchtec.c + 'W' 60-61 linux/watch_queue.h +-'X' all fs/xfs/xfs_fs.h, conflict! ++'X' all fs/xfs/xfs_fs.h, conflict! + fs/xfs/linux-2.6/xfs_ioctl32.h, + include/linux/falloc.h, + linux/fs.h, +-'X' all fs/ocfs2/ocfs_fs.h conflict! +-'X' 01 linux/pktcdvd.h conflict! ++'X' all fs/ocfs2/ocfs_fs.h conflict! ++'X' 01 linux/pktcdvd.h conflict! + 'Z' 14-15 drivers/message/fusion/mptctl.h +-'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices +- +-'a' all linux/atm*.h, linux/sonet.h ATM on linux +- +-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver +-'b' 00-FF conflict! bit3 vme host bridge +- +-'b' 00-0F linux/dma-buf.h conflict! +-'c' 00-7F linux/comstats.h conflict! +-'c' 00-7F linux/coda.h conflict! +-'c' 00-1F linux/chio.h conflict! +-'c' 80-9F arch/s390/include/asm/chsc.h conflict! ++'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices ++ ++'a' all linux/atm*.h, linux/sonet.h ATM on linux ++ ++'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver ++'b' 00-FF conflict! bit3 vme host bridge ++ ++'b' 00-0F linux/dma-buf.h conflict! ++'c' 00-7F linux/comstats.h conflict! ++'c' 00-7F linux/coda.h conflict! ++'c' 00-1F linux/chio.h conflict! ++'c' 80-9F arch/s390/include/asm/chsc.h conflict! + 'c' A0-AF arch/x86/include/asm/msr.h conflict! +-'d' 00-FF linux/char/drm/drm.h conflict! +-'d' 02-40 pcmcia/ds.h conflict! ++'d' 00-FF linux/char/drm/drm.h conflict! ++'d' 02-40 pcmcia/ds.h conflict! + 'd' F0-FF linux/digi1.h +-'e' all linux/digi1.h conflict! +-'f' 00-1F linux/ext2_fs.h conflict! +-'f' 00-1F linux/ext3_fs.h conflict! +-'f' 00-0F fs/jfs/jfs_dinode.h conflict! +-'f' 00-0F fs/ext4/ext4.h conflict! +-'f' 00-0F linux/fs.h conflict! +-'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict! ++'e' all linux/digi1.h conflict! ++'f' 00-1F linux/ext2_fs.h conflict! ++'f' 00-1F linux/ext3_fs.h conflict! ++'f' 00-0F fs/jfs/jfs_dinode.h conflict! ++'f' 00-0F fs/ext4/ext4.h conflict! ++'f' 00-0F linux/fs.h conflict! ++'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict! + 'f' 13-27 linux/fscrypt.h + 'f' 81-8F linux/fsverity.h + 'g' 00-0F linux/usb/gadgetfs.h + 'g' 20-2F linux/usb/g_printer.h +-'h' 00-7F conflict! Charon filesystem +- +-'h' 00-1F linux/hpet.h conflict! ++'h' 00-7F conflict! Charon filesystem ++ ++'h' 00-1F linux/hpet.h conflict! + 'h' 80-8F fs/hfsplus/ioctl.c +-'i' 00-3F linux/i2o-dev.h conflict! +-'i' 0B-1F linux/ipmi.h conflict! ++'i' 00-3F linux/i2o-dev.h conflict! ++'i' 0B-1F linux/ipmi.h conflict! + 'i' 80-8F linux/i8k.h +-'i' 90-9F `linux/iio/*.h` IIO ++'i' 90-9F `linux/iio/*.h` IIO + 'j' 00-3F linux/joystick.h +-'k' 00-0F linux/spi/spidev.h conflict! +-'k' 00-05 video/kyro.h conflict! +-'k' 10-17 linux/hsi/hsi_char.h HSI character device +-'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system +- +-'l' 40-7F linux/udf_fs_i.h in development: +- +-'m' 00-09 linux/mmtimer.h conflict! +-'m' all linux/mtio.h conflict! +-'m' all linux/soundcard.h conflict! +-'m' all linux/synclink.h conflict! +-'m' 00-19 drivers/message/fusion/mptctl.h conflict! +-'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict! ++'k' 00-0F linux/spi/spidev.h conflict! ++'k' 00-05 video/kyro.h conflict! ++'k' 10-17 linux/hsi/hsi_char.h HSI character device ++'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system ++ ++'l' 40-7F linux/udf_fs_i.h in development: ++ ++'m' 00-09 linux/mmtimer.h conflict! ++'m' all linux/mtio.h conflict! ++'m' all linux/soundcard.h conflict! ++'m' all linux/synclink.h conflict! ++'m' 00-19 drivers/message/fusion/mptctl.h conflict! ++'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict! + 'n' 00-7F linux/ncp_fs.h and fs/ncpfs/ioctl.c +-'n' 80-8F uapi/linux/nilfs2_api.h NILFS2 +-'n' E0-FF linux/matroxfb.h matroxfb +-'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2 +-'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps) +-'o' 40-41 mtd/ubi-user.h UBI +-'o' 01-A1 `linux/dvb/*.h` DVB +-'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this) +-'p' 00-1F linux/rtc.h conflict! ++'n' 80-8F uapi/linux/nilfs2_api.h NILFS2 ++'n' E0-FF linux/matroxfb.h matroxfb ++'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2 ++'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps) ++'o' 40-41 mtd/ubi-user.h UBI ++'o' 01-A1 `linux/dvb/*.h` DVB ++'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this) ++'p' 00-1F linux/rtc.h conflict! + 'p' 40-7F linux/nvram.h +-'p' 80-9F linux/ppdev.h user-space parport +- +-'p' A1-A5 linux/pps.h LinuxPPS +- ++'p' 80-9F linux/ppdev.h user-space parport ++ ++'p' A1-A5 linux/pps.h LinuxPPS ++ + 'q' 00-1F linux/serio.h +-'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK +- linux/ixjuser.h ++'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK ++ linux/ixjuser.h + 'r' 00-1F linux/msdos_fs.h and fs/fat/dir.c + 's' all linux/cdk.h + 't' 00-7F linux/ppp-ioctl.h + 't' 80-8F linux/isdn_ppp.h +-'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM +-'u' 00-1F linux/smb_fs.h gone +-'u' 20-3F linux/uvcvideo.h USB video class host driver +-'u' 40-4f linux/udmabuf.h userspace dma-buf misc device +-'v' 00-1F linux/ext2_fs.h conflict! +-'v' 00-1F linux/fs.h conflict! +-'v' 00-0F linux/sonypi.h conflict! +-'v' 00-0F media/v4l2-subdev.h conflict! +-'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API +-'v' C0-FF linux/meye.h conflict! +-'w' all CERN SCI driver +-'y' 00-1F packet based user level communications +- +-'z' 00-3F CAN bus card conflict! +- +-'z' 40-7F CAN bus card conflict! +- +-'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict! ++'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM ++'u' 00-1F linux/smb_fs.h gone ++'u' 20-3F linux/uvcvideo.h USB video class host driver ++'u' 40-4f linux/udmabuf.h userspace dma-buf misc device ++'v' 00-1F linux/ext2_fs.h conflict! ++'v' 00-1F linux/fs.h conflict! ++'v' 00-0F linux/sonypi.h conflict! ++'v' 00-0F media/v4l2-subdev.h conflict! ++'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API ++'v' C0-FF linux/meye.h conflict! ++'w' all CERN SCI driver ++'y' 00-1F packet based user level communications ++ ++'z' 00-3F CAN bus card conflict! ++ ++'z' 40-7F CAN bus card conflict! ++ ++'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict! + '|' 00-7F linux/media.h + 0x80 00-1F linux/fb.h + 0x81 00-1F linux/vduse.h + 0x89 00-06 arch/x86/include/asm/sockios.h + 0x89 0B-DF linux/sockios.h +-0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range +-0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range ++0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range ++0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range + 0x8B all linux/wireless.h +-0x8C 00-3F WiNRADiO driver +- ++0x8C 00-3F WiNRADiO driver ++ + 0x90 00 drivers/cdrom/sbpcd.h + 0x92 00-0F drivers/usb/mon/mon_bin.c + 0x93 60-7F linux/auto_fs.h +-0x94 all fs/btrfs/ioctl.h Btrfs filesystem +- and linux/fs.h some lifted to vfs/generic +-0x97 00-7F fs/ceph/ioctl.h Ceph file system +-0x99 00-0F 537-Addinboard driver +- +-0xA0 all linux/sdp/sdp.h Industrial Device Project +- +-0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver +-0xA2 all uapi/linux/acrn.h ACRN hypervisor +-0xA3 80-8F Port ACL in development: +- ++0x94 all fs/btrfs/ioctl.h Btrfs filesystem ++ and linux/fs.h some lifted to vfs/generic ++0x97 00-7F fs/ceph/ioctl.h Ceph file system ++0x99 00-0F 537-Addinboard driver ++ ++0xA0 all linux/sdp/sdp.h Industrial Device Project ++ ++0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver ++0xA2 all uapi/linux/acrn.h ACRN hypervisor ++0xA3 80-8F Port ACL in development: ++ + 0xA3 90-9F linux/dtlk.h +-0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem +-0xA4 00-1F uapi/asm/sgx.h +-0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator +- +-0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver +- ++0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem ++0xA4 00-1F uapi/asm/sgx.h ++0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator ++ ++0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver ++ + 0xAA 00-3F linux/uapi/linux/userfaultfd.h + 0xAB 00-1F linux/nbd.h + 0xAC 00-1F linux/raw.h +-0xAD 00 Netfilter device in development: +- +-0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine +- +-0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine +- +-0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves +-0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor +-0xB0 all RATIO devices in development: +- +-0xB1 00-1F PPPoX +- ++0xAD 00 Netfilter device in development: ++ ++0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine ++ ++0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine ++ ++0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves ++0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor ++0xB0 all RATIO devices in development: ++ ++0xB1 00-1F PPPoX ++ + 0xB3 00 linux/mmc/ioctl.h +-0xB4 00-0F linux/gpio.h +-0xB5 00-0F uapi/linux/rpmsg.h ++0xB4 00-0F linux/gpio.h ++0xB5 00-0F uapi/linux/rpmsg.h + 0xB6 all linux/fpga-dfl.h +-0xB7 all uapi/linux/remoteproc_cdev.h +-0xB7 all uapi/linux/nsfs.h > ++0xB7 all uapi/linux/remoteproc_cdev.h ++0xB7 all uapi/linux/nsfs.h > + 0xC0 00-0F linux/usb/iowarrior.h + 0xCA 00-0F uapi/misc/cxl.h + 0xCA 10-2F uapi/misc/ocxl.h + 0xCA 80-BF uapi/scsi/cxlflash_ioctl.h +-0xCB 00-1F CBM serial IEC bus in development: +- +-0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver ++0xCB 00-1F CBM serial IEC bus in development: ++ ++0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver + 0xCD 01 linux/reiserfs_fs.h +-0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices ++0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices + 0xCF 02 fs/smb/client/cifs_ioctl.h + 0xDB 00-0F drivers/char/mwave/mwavepub.h +-0xDD 00-3F ZFCP device driver see drivers/s390/scsi/ +- ++0xDD 00-3F ZFCP device driver see drivers/s390/scsi/ ++ + 0xE5 00-3F linux/fuse.h +-0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver +-0xEE 00-09 uapi/linux/pfrut.h Platform Firmware Runtime Update and Telemetry +-0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development) +- +-0xF6 all LTTng Linux Trace Toolkit Next Generation +- +-0xF8 all arch/x86/include/uapi/asm/amd_hsmp.h AMD HSMP EPYC system management interface driver +- ++0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver ++0xEE 00-09 uapi/linux/pfrut.h Platform Firmware Runtime Update and Telemetry ++0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development) ++ ++0xF6 all LTTng Linux Trace Toolkit Next Generation ++ ++0xF8 all arch/x86/include/uapi/asm/amd_hsmp.h AMD HSMP EPYC system management interface driver ++ + 0xFD all linux/dm-ioctl.h + 0xFE all linux/isst_if.h +-==== ===== ======================================================= ================================================================ ++==== ===== ========================================================= ================================================================ diff --git a/queue-6.6/drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch b/queue-6.6/drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch new file mode 100644 index 0000000000..8bcfe3880c --- /dev/null +++ b/queue-6.6/drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch @@ -0,0 +1,58 @@ +From sashal@kernel.org Thu Jun 25 16:14:46 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 10:14:42 -0400 +Subject: drivers/base/memory: set mem->altmap after successful device registration +To: stable@vger.kernel.org +Cc: Georgi Djakov , "Oscar Salvador (SUSE)" , Vishal Verma , Mike Rapoport , Richard Cheng , David Hildenbrand , Georgi Djakov , Greg Kroah-Hartman , "Rafael J. Wysocki" , Andrew Morton , Sasha Levin +Message-ID: <20260625141442.2436561-1-sashal@kernel.org> + +From: Georgi Djakov + +[ Upstream commit a2b8d7827f48ee54a686cb80e4a1d0ff954ec42a ] + +If __add_memory_block() fails at xa_store() (under memory pressure for +example), device_unregister() is called, which eventually triggers +memory_block_release() with mem->altmap still set, causing a +WARN_ON(mem->altmap). This was triggered by modifying virtio-mem driver. + +Fix this by delaying the assignment of mem->altmap until after +__add_memory_block() has succeeded. + +Link: https://lore.kernel.org/20260514092657.3057141-1-georgi.djakov@oss.qualcomm.com +Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block") +Signed-off-by: Georgi Djakov +Acked-by: Oscar Salvador (SUSE) +Cc: Vishal Verma +Cc: Mike Rapoport +Cc: Richard Cheng +Cc: David Hildenbrand +Cc: Georgi Djakov +Cc: Greg Kroah-Hartman +Cc: "Rafael J. Wysocki" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/memory.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -773,7 +773,6 @@ static int add_memory_block(unsigned lon + mem->start_section_nr = block_id * sections_per_block; + mem->state = state; + mem->nid = NUMA_NO_NODE; +- mem->altmap = altmap; + INIT_LIST_HEAD(&mem->group_next); + + #ifndef CONFIG_NUMA +@@ -791,6 +790,8 @@ static int add_memory_block(unsigned lon + if (ret) + return ret; + ++ mem->altmap = altmap; ++ + if (group) { + mem->group = group; + list_add(&mem->group_next, &group->memory_blocks); diff --git a/queue-6.6/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch b/queue-6.6/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch new file mode 100644 index 0000000000..acf14bda43 --- /dev/null +++ b/queue-6.6/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch @@ -0,0 +1,51 @@ +From stable+bounces-268554-greg=kroah.com@vger.kernel.org Thu Jun 25 15:55:04 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 09:54:53 -0400 +Subject: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails +To: stable@vger.kernel.org +Cc: Stepan Ionichev , Andy Shevchenko , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260625135453.2421817-1-sashal@kernel.org> + +From: Stepan Ionichev + +[ Upstream commit 10fc708b4de7f86002d2d735a2dbf3b5b7f65692 ] + +dw8250_probe() registers the 8250 port via serial8250_register_8250_port() +and then, if the device has a clock, registers a clock notifier. If +clk_notifier_register() fails, probe returns the error but leaves the +8250 port registered. The matching serial8250_unregister_port() lives +in dw8250_remove(), which is not called when probe fails, so the port +slot stays occupied until the device is rebound or the system is +rebooted. The devm-allocated driver data is freed while the port still +references it (via the saved private_data and serial_in/serial_out +callbacks), so any access to that port slot before a rebind is a +use-after-free hazard. + +Unregister the port on the clk_notifier_register() error path. + +Fixes: cc816969d7b5 ("serial: 8250_dw: Fix common clocks usage race condition") +Cc: stable@vger.kernel.org +Signed-off-by: Stepan Ionichev +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20260514143746.23671-2-sozdayvek@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_dw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -688,8 +688,10 @@ static int dw8250_probe(struct platform_ + */ + if (data->clk) { + err = clk_notifier_register(data->clk, &data->clk_notifier); +- if (err) ++ if (err) { ++ serial8250_unregister_port(data->data.line); + return dev_err_probe(dev, err, "Failed to set the clock notifier\n"); ++ } + queue_work(system_unbound_wq, &data->clk_work); + } + diff --git a/queue-6.6/serial-qcom_geni-fix-rx-dma-stall-when-se_dma_rx_len_in-is-zero.patch b/queue-6.6/serial-qcom_geni-fix-rx-dma-stall-when-se_dma_rx_len_in-is-zero.patch new file mode 100644 index 0000000000..c4c3a70e0d --- /dev/null +++ b/queue-6.6/serial-qcom_geni-fix-rx-dma-stall-when-se_dma_rx_len_in-is-zero.patch @@ -0,0 +1,55 @@ +From stable+bounces-268548-greg=kroah.com@vger.kernel.org Thu Jun 25 15:41:49 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 09:41:41 -0400 +Subject: serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero +To: stable@vger.kernel.org +Cc: Viken Dadhaniya , Bartosz Golaszewski , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260625134141.2411620-1-sashal@kernel.org> + +From: Viken Dadhaniya + +[ Upstream commit b93062b6d8a1b2d9bad235cac25558a909819026 ] + +In qcom_geni_serial_handle_rx_dma(), geni_se_rx_dma_unprep() clears +port->rx_dma_addr before SE_DMA_RX_LEN_IN is read. If the register is zero, +for example when the RX stale counter fires on an idle line, the handler +returns without calling geni_se_rx_dma_prep(). + +The next RX DMA interrupt then hits the !port->rx_dma_addr guard and +returns immediately, so the RX DMA buffer is never rearmed and later input +is lost. + +Keep the handler on the rearm path when rx_in is zero. Warn about the +unexpected zero-length DMA completion, skip received-data handling, and +always call geni_se_rx_dma_prep(). + +Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA") +Cc: stable@vger.kernel.org +Reviewed-by: Bartosz Golaszewski +Signed-off-by: Viken Dadhaniya +Link: https://patch.msgid.link/20260528-serial-rx-0-byte-fix-v2-1-b4195cfe342f@oss.qualcomm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -838,12 +838,9 @@ static void qcom_geni_serial_handle_rx_d + port->rx_dma_addr = 0; + + rx_in = readl(uport->membase + SE_DMA_RX_LEN_IN); +- if (!rx_in) { +- dev_warn(uport->dev, "serial engine reports 0 RX bytes in!\n"); +- return; +- } +- +- if (!drop) ++ if (!rx_in) ++ dev_warn_ratelimited(uport->dev, "serial engine reports 0 RX bytes in!\n"); ++ else if (!drop) + handle_rx_uart(uport, rx_in, drop); + + ret = geni_se_rx_dma_prep(&port->se, port->rx_buf, diff --git a/queue-6.6/series b/queue-6.6/series index 6b537b2cee..0c3cb0ccac 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -166,3 +166,10 @@ nfsd-check-get_user-return-when-reading-princhashlen.patch nfsv4-pnfs-reject-zero-length-r_addr-in-nfs4_decode_mp_ds_addr.patch nfs-prevent-resource-leak-in-nfs_alloc_server.patch ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch +serial-qcom_geni-fix-rx-dma-stall-when-se_dma_rx_len_in-is-zero.patch +serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch +drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch +documentation-ioctl-number-extend-include-file-column-width.patch +crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch +crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch +crypto-qat-remove-unused-character-device-and-ioctls.patch