From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 14:09:43 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v5.10.260~26 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=19eeca325a3b31b4a40f322e80c27d88bbff4ac0;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: crypto-qat-remove-unused-character-device-and-ioctls.patch crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch documentation-ioctl-number-extend-include-file-column-width.patch documentation-ioctl-number-fix-linuxppc-dev-mailto-link.patch drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch input-include-export.h-in-modules-using-export_symbol.patch input-rmi4-refactor-register-descriptor-parsing.patch serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch --- diff --git a/queue-6.12/crypto-qat-remove-unused-character-device-and-ioctls.patch b/queue-6.12/crypto-qat-remove-unused-character-device-and-ioctls.patch new file mode 100644 index 0000000000..ced67377d2 --- /dev/null +++ b/queue-6.12/crypto-qat-remove-unused-character-device-and-ioctls.patch @@ -0,0 +1,731 @@ +From stable+bounces-268568-greg=kroah.com@vger.kernel.org Thu Jun 25 16:15:17 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 10:08:46 -0400 +Subject: crypto: qat - remove unused character device and IOCTLs +To: stable@vger.kernel.org +Cc: Giovanni Cabiddu , Zhi Wang , Bin Yu , MingYu Wang , Ahsan Atta , Herbert Xu , Sasha Levin +Message-ID: <20260625140846.2431963-5-sashal@kernel.org> + +From: Giovanni Cabiddu + +[ Upstream commit d237230728c567297f2f98b425d63156ab2ed17f ] + +The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs +for device configuration, start, stop, status query and enumeration. +These IOCTLs are not part of any public uAPI header and have no known +in-tree or out-of-tree users. Device lifecycle is already managed via +sysfs. + +The ioctl interface also increases the attack surface and is the +subject of a number of bug reports. + +Remove the character device, the IOCTL definitions, and the related +data structures (adf_dev_status_info, adf_user_cfg_key_val, +adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused +adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal +module_init/module_exit hooks for workqueue, AER, and crypto/compression +algorithm registration. + +Clean up leftover dead code that was only reachable from the removed +IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), +adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), +adf_get_vf_real_id() and the unused ADF_CFG macros. + +Additionally, drop the entry associated to QAT IOCTLs in +ioctl-number.rst. + +Cc: stable@vger.kernel.org +Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") +Reported-by: Zhi Wang +Reported-by: Bin Yu +Reported-by: MingYu Wang +Closes: https://lore.kernel.org/all/61d6d499.ab89.19b9b7f3186.Coremail.wangzhi_xd@stu.xidian.edu.cn/ +Link: https://lore.kernel.org/all/20260508034841.256794-1-w15303746062@163.com/ +Link: https://lore.kernel.org/all/20260508023542.256299-1-w15303746062@163.com/ +Link: https://lore.kernel.org/all/20260504025120.98242-1-w15303746062@163.com/ +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Ahsan Atta +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/userspace-api/ioctl/ioctl-number.rst | 1 + drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 + drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 + drivers/crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - + drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - + drivers/crypto/intel/qat/qat_common/adf_common_drv.h | 3 + drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 ------------------- + drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 --- + 8 files changed, 1 insertion(+), 558 deletions(-) + delete mode 100644 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h + +--- a/Documentation/userspace-api/ioctl/ioctl-number.rst ++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst +@@ -225,7 +225,6 @@ Code Seq# Include File + + 'a' all linux/atm*.h, linux/sonet.h ATM on linux + +-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver + 'b' 00-FF conflict! bit3 vme host bridge + + 'b' 00-0F linux/dma-buf.h conflict! +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.c +@@ -103,16 +103,6 @@ static void adf_cfg_section_del_all(stru + static void adf_cfg_section_del_all_except(struct list_head *head, + const char *section_name); + +-void adf_cfg_del_all(struct adf_accel_dev *accel_dev) +-{ +- struct adf_cfg_device_data *dev_cfg_data = accel_dev->cfg; +- +- down_write(&dev_cfg_data->lock); +- adf_cfg_section_del_all(&dev_cfg_data->sec_list); +- up_write(&dev_cfg_data->lock); +- clear_bit(ADF_STATUS_CONFIGURED, &accel_dev->status); +-} +- + void adf_cfg_del_all_except(struct adf_accel_dev *accel_dev, + const char *section_name) + { +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg.h ++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.h +@@ -34,7 +34,6 @@ void adf_cfg_dev_remove(struct adf_accel + void adf_cfg_dev_dbgfs_add(struct adf_accel_dev *accel_dev); + void adf_cfg_dev_dbgfs_rm(struct adf_accel_dev *accel_dev); + int adf_cfg_section_add(struct adf_accel_dev *accel_dev, const char *name); +-void adf_cfg_del_all(struct adf_accel_dev *accel_dev); + void adf_cfg_del_all_except(struct adf_accel_dev *accel_dev, + const char *section_name); + int adf_cfg_add_key_value_param(struct adf_accel_dev *accel_dev, +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h ++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h +@@ -4,18 +4,11 @@ + #define ADF_CFG_COMMON_H_ + + #include +-#include + + #define ADF_CFG_MAX_STR_LEN 64 + #define ADF_CFG_MAX_KEY_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN + #define ADF_CFG_MAX_VAL_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN + #define ADF_CFG_MAX_SECTION_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN +-#define ADF_CFG_BASE_DEC 10 +-#define ADF_CFG_BASE_HEX 16 +-#define ADF_CFG_ALL_DEVICES 0xFE +-#define ADF_CFG_NO_DEVICE 0xFF +-#define ADF_CFG_AFFINITY_WHATEVER 0xFF +-#define MAX_DEVICE_NAME_SIZE 32 + #define ADF_MAX_DEVICES (32 * 32) + #define ADF_DEVS_ARRAY_SIZE BITS_TO_LONGS(ADF_MAX_DEVICES) + +@@ -49,29 +42,4 @@ enum adf_device_type { + DEV_4XXX, + DEV_420XX, + }; +- +-struct adf_dev_status_info { +- enum adf_device_type type; +- __u32 accel_id; +- __u32 instance_id; +- __u8 num_ae; +- __u8 num_accel; +- __u8 num_logical_accel; +- __u8 banks_per_accel; +- __u8 state; +- __u8 bus; +- __u8 dev; +- __u8 fun; +- char name[MAX_DEVICE_NAME_SIZE]; +-}; +- +-#define ADF_CTL_IOC_MAGIC 'a' +-#define IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS _IOW(ADF_CTL_IOC_MAGIC, 0, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_STOP_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 1, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_START_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 2, \ +- struct adf_user_cfg_ctl_data) +-#define IOCTL_STATUS_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 3, __u32) +-#define IOCTL_GET_NUM_DEVICES _IOW(ADF_CTL_IOC_MAGIC, 4, __s32) + #endif +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg_user.h ++++ /dev/null +@@ -1,38 +0,0 @@ +-/* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) */ +-/* Copyright(c) 2014 - 2020 Intel Corporation */ +-#ifndef ADF_CFG_USER_H_ +-#define ADF_CFG_USER_H_ +- +-#include "adf_cfg_common.h" +-#include "adf_cfg_strings.h" +- +-struct adf_user_cfg_key_val { +- char key[ADF_CFG_MAX_KEY_LEN_IN_BYTES]; +- char val[ADF_CFG_MAX_VAL_LEN_IN_BYTES]; +- union { +- struct adf_user_cfg_key_val *next; +- __u64 padding3; +- }; +- enum adf_cfg_val_type type; +-} __packed; +- +-struct adf_user_cfg_section { +- char name[ADF_CFG_MAX_SECTION_LEN_IN_BYTES]; +- union { +- struct adf_user_cfg_key_val *params; +- __u64 padding1; +- }; +- union { +- struct adf_user_cfg_section *next; +- __u64 padding3; +- }; +-} __packed; +- +-struct adf_user_cfg_ctl_data { +- union { +- struct adf_user_cfg_section *config_section; +- __u64 padding; +- }; +- __u8 device_id; +-} __packed; +-#endif +--- a/drivers/crypto/intel/qat/qat_common/adf_common_drv.h ++++ b/drivers/crypto/intel/qat/qat_common/adf_common_drv.h +@@ -68,11 +68,8 @@ int adf_devmgr_add_dev(struct adf_accel_ + void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev, + struct adf_accel_dev *pf); + struct list_head *adf_devmgr_get_head(void); +-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id); + struct adf_accel_dev *adf_devmgr_get_first(void); + struct adf_accel_dev *adf_devmgr_pci_to_accel_dev(struct pci_dev *pci_dev); +-int adf_devmgr_verify_id(u32 id); +-void adf_devmgr_get_num_dev(u32 *num); + int adf_devmgr_in_reset(struct adf_accel_dev *accel_dev); + int adf_dev_started(struct adf_accel_dev *accel_dev); + int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev); +--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c +@@ -2,410 +2,13 @@ + /* Copyright(c) 2014 - 2020 Intel Corporation */ + + #include ++#include + #include +-#include +-#include +-#include +-#include +-#include +-#include +-#include + +-#include "adf_accel_devices.h" + #include "adf_common_drv.h" +-#include "adf_cfg.h" +-#include "adf_cfg_common.h" +-#include "adf_cfg_user.h" +- +-#define ADF_CFG_MAX_SECTION 512 +-#define ADF_CFG_MAX_KEY_VAL 256 +- +-#define DEVICE_NAME "qat_adf_ctl" +- +-static DEFINE_MUTEX(adf_ctl_lock); +-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg); +- +-static const struct file_operations adf_ctl_ops = { +- .owner = THIS_MODULE, +- .unlocked_ioctl = adf_ctl_ioctl, +- .compat_ioctl = compat_ptr_ioctl, +-}; +- +-static const struct class adf_ctl_class = { +- .name = DEVICE_NAME, +-}; +- +-struct adf_ctl_drv_info { +- unsigned int major; +- struct cdev drv_cdev; +-}; +- +-static struct adf_ctl_drv_info adf_ctl_drv; +- +-static void adf_chr_drv_destroy(void) +-{ +- device_destroy(&adf_ctl_class, MKDEV(adf_ctl_drv.major, 0)); +- cdev_del(&adf_ctl_drv.drv_cdev); +- class_unregister(&adf_ctl_class); +- unregister_chrdev_region(MKDEV(adf_ctl_drv.major, 0), 1); +-} +- +-static int adf_chr_drv_create(void) +-{ +- dev_t dev_id; +- struct device *drv_device; +- int ret; +- +- if (alloc_chrdev_region(&dev_id, 0, 1, DEVICE_NAME)) { +- pr_err("QAT: unable to allocate chrdev region\n"); +- return -EFAULT; +- } +- +- ret = class_register(&adf_ctl_class); +- if (ret) +- goto err_chrdev_unreg; +- +- adf_ctl_drv.major = MAJOR(dev_id); +- cdev_init(&adf_ctl_drv.drv_cdev, &adf_ctl_ops); +- if (cdev_add(&adf_ctl_drv.drv_cdev, dev_id, 1)) { +- pr_err("QAT: cdev add failed\n"); +- goto err_class_destr; +- } +- +- drv_device = device_create(&adf_ctl_class, NULL, +- MKDEV(adf_ctl_drv.major, 0), +- NULL, DEVICE_NAME); +- if (IS_ERR(drv_device)) { +- pr_err("QAT: failed to create device\n"); +- goto err_cdev_del; +- } +- return 0; +-err_cdev_del: +- cdev_del(&adf_ctl_drv.drv_cdev); +-err_class_destr: +- class_unregister(&adf_ctl_class); +-err_chrdev_unreg: +- unregister_chrdev_region(dev_id, 1); +- return -EFAULT; +-} +- +-static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg) +-{ +- struct adf_user_cfg_ctl_data *cfg_data; +- +- cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); +- if (IS_ERR(cfg_data)) +- pr_err("QAT: failed to copy from user cfg_data.\n"); +- return cfg_data; +-} +- +-static int adf_add_key_value_data(struct adf_accel_dev *accel_dev, +- const char *section, +- const struct adf_user_cfg_key_val *key_val) +-{ +- if (key_val->type == ADF_HEX) { +- long *ptr = (long *)key_val->val; +- long val = *ptr; +- +- if (adf_cfg_add_key_value_param(accel_dev, section, +- key_val->key, (void *)val, +- key_val->type)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add hex keyvalue.\n"); +- return -EFAULT; +- } +- } else { +- if (adf_cfg_add_key_value_param(accel_dev, section, +- key_val->key, key_val->val, +- key_val->type)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add keyvalue.\n"); +- return -EFAULT; +- } +- } +- return 0; +-} +- +-static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev, +- struct adf_user_cfg_ctl_data *ctl_data) +-{ +- struct adf_user_cfg_key_val key_val; +- struct adf_user_cfg_key_val *params_head; +- struct adf_user_cfg_section section, *section_head; +- int i, j; +- +- section_head = ctl_data->config_section; +- +- for (i = 0; section_head && i < ADF_CFG_MAX_SECTION; i++) { +- if (copy_from_user(§ion, (void __user *)section_head, +- sizeof(*section_head))) { +- dev_err(&GET_DEV(accel_dev), +- "failed to copy section info\n"); +- goto out_err; +- } +- +- if (adf_cfg_section_add(accel_dev, section.name)) { +- dev_err(&GET_DEV(accel_dev), +- "failed to add section.\n"); +- goto out_err; +- } +- +- params_head = section.params; +- +- for (j = 0; params_head && j < ADF_CFG_MAX_KEY_VAL; j++) { +- if (copy_from_user(&key_val, (void __user *)params_head, +- sizeof(key_val))) { +- dev_err(&GET_DEV(accel_dev), +- "Failed to copy keyvalue.\n"); +- goto out_err; +- } +- if (adf_add_key_value_data(accel_dev, section.name, +- &key_val)) { +- goto out_err; +- } +- params_head = key_val.next; +- } +- section_head = section.next; +- } +- return 0; +-out_err: +- adf_cfg_del_all(accel_dev); +- return -EFAULT; +-} +- +-static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- struct adf_user_cfg_ctl_data *ctl_data; +- struct adf_accel_dev *accel_dev; +- int ret = 0; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); +- if (!accel_dev) { +- ret = -EFAULT; +- goto out; +- } +- +- if (adf_dev_started(accel_dev)) { +- ret = -EFAULT; +- goto out; +- } +- +- if (adf_copy_key_value_data(accel_dev, ctl_data)) { +- ret = -EFAULT; +- goto out; +- } +- set_bit(ADF_STATUS_CONFIGURED, &accel_dev->status); +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_is_device_in_use(int id) +-{ +- struct adf_accel_dev *dev; +- +- list_for_each_entry(dev, adf_devmgr_get_head(), list) { +- if (id == dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (adf_devmgr_in_reset(dev) || adf_dev_in_use(dev)) { +- dev_info(&GET_DEV(dev), +- "device qat_dev%d is busy\n", +- dev->accel_id); +- return -EBUSY; +- } +- } +- } +- return 0; +-} +- +-static void adf_ctl_stop_devices(u32 id) +-{ +- struct adf_accel_dev *accel_dev; +- +- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) { +- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (!adf_dev_started(accel_dev)) +- continue; +- +- /* First stop all VFs */ +- if (!accel_dev->is_vf) +- continue; +- +- adf_dev_down(accel_dev); +- } +- } +- +- list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) { +- if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) { +- if (!adf_dev_started(accel_dev)) +- continue; +- +- adf_dev_down(accel_dev); +- } +- } +-} +- +-static int adf_ctl_ioctl_dev_stop(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- int ret; +- struct adf_user_cfg_ctl_data *ctl_data; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- if (adf_devmgr_verify_id(ctl_data->device_id)) { +- pr_err("QAT: Device %d not found\n", ctl_data->device_id); +- ret = -ENODEV; +- goto out; +- } +- +- ret = adf_ctl_is_device_in_use(ctl_data->device_id); +- if (ret) +- goto out; +- +- if (ctl_data->device_id == ADF_CFG_ALL_DEVICES) +- pr_info("QAT: Stopping all acceleration devices.\n"); +- else +- pr_info("QAT: Stopping acceleration device qat_dev%d.\n", +- ctl_data->device_id); +- +- adf_ctl_stop_devices(ctl_data->device_id); +- +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_ioctl_dev_start(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- int ret; +- struct adf_user_cfg_ctl_data *ctl_data; +- struct adf_accel_dev *accel_dev; +- +- ctl_data = adf_ctl_alloc_resources(arg); +- if (IS_ERR(ctl_data)) +- return PTR_ERR(ctl_data); +- +- ret = -ENODEV; +- accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); +- if (!accel_dev) +- goto out; +- +- dev_info(&GET_DEV(accel_dev), +- "Starting acceleration device qat_dev%d.\n", +- ctl_data->device_id); +- +- ret = adf_dev_up(accel_dev, false); +- +- if (ret) { +- dev_err(&GET_DEV(accel_dev), "Failed to start qat_dev%d\n", +- ctl_data->device_id); +- adf_dev_down(accel_dev); +- } +-out: +- kfree(ctl_data); +- return ret; +-} +- +-static int adf_ctl_ioctl_get_num_devices(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- u32 num_devices = 0; +- +- adf_devmgr_get_num_dev(&num_devices); +- if (copy_to_user((void __user *)arg, &num_devices, sizeof(num_devices))) +- return -EFAULT; +- +- return 0; +-} +- +-static int adf_ctl_ioctl_get_status(struct file *fp, unsigned int cmd, +- unsigned long arg) +-{ +- struct adf_hw_device_data *hw_data; +- struct adf_dev_status_info dev_info; +- struct adf_accel_dev *accel_dev; +- +- if (copy_from_user(&dev_info, (void __user *)arg, +- sizeof(struct adf_dev_status_info))) { +- pr_err("QAT: failed to copy from user.\n"); +- return -EFAULT; +- } +- +- accel_dev = adf_devmgr_get_dev_by_id(dev_info.accel_id); +- if (!accel_dev) +- return -ENODEV; +- +- hw_data = accel_dev->hw_device; +- dev_info.state = adf_dev_started(accel_dev) ? DEV_UP : DEV_DOWN; +- dev_info.num_ae = hw_data->get_num_aes(hw_data); +- dev_info.num_accel = hw_data->get_num_accels(hw_data); +- dev_info.num_logical_accel = hw_data->num_logical_accel; +- dev_info.banks_per_accel = hw_data->num_banks +- / hw_data->num_logical_accel; +- strscpy(dev_info.name, hw_data->dev_class->name, sizeof(dev_info.name)); +- dev_info.instance_id = hw_data->instance_id; +- dev_info.type = hw_data->dev_class->type; +- dev_info.bus = accel_to_pci_dev(accel_dev)->bus->number; +- dev_info.dev = PCI_SLOT(accel_to_pci_dev(accel_dev)->devfn); +- dev_info.fun = PCI_FUNC(accel_to_pci_dev(accel_dev)->devfn); +- +- if (copy_to_user((void __user *)arg, &dev_info, +- sizeof(struct adf_dev_status_info))) { +- dev_err(&GET_DEV(accel_dev), "failed to copy status.\n"); +- return -EFAULT; +- } +- return 0; +-} +- +-static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) +-{ +- int ret; +- +- if (mutex_lock_interruptible(&adf_ctl_lock)) +- return -EFAULT; +- +- switch (cmd) { +- case IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS: +- ret = adf_ctl_ioctl_dev_config(fp, cmd, arg); +- break; +- +- case IOCTL_STOP_ACCEL_DEV: +- ret = adf_ctl_ioctl_dev_stop(fp, cmd, arg); +- break; +- +- case IOCTL_START_ACCEL_DEV: +- ret = adf_ctl_ioctl_dev_start(fp, cmd, arg); +- break; +- +- case IOCTL_GET_NUM_DEVICES: +- ret = adf_ctl_ioctl_get_num_devices(fp, cmd, arg); +- break; +- +- case IOCTL_STATUS_ACCEL_DEV: +- ret = adf_ctl_ioctl_get_status(fp, cmd, arg); +- break; +- default: +- pr_err_ratelimited("QAT: Invalid ioctl %d\n", cmd); +- ret = -EFAULT; +- break; +- } +- mutex_unlock(&adf_ctl_lock); +- return ret; +-} + + static int __init adf_register_ctl_device_driver(void) + { +- if (adf_chr_drv_create()) +- goto err_chr_dev; +- + if (adf_init_misc_wq()) + goto err_misc_wq; + +@@ -437,15 +40,11 @@ err_pf_wq: + err_aer: + adf_exit_misc_wq(); + err_misc_wq: +- adf_chr_drv_destroy(); +-err_chr_dev: +- mutex_destroy(&adf_ctl_lock); + return -EFAULT; + } + + static void __exit adf_unregister_ctl_device_driver(void) + { +- adf_chr_drv_destroy(); + adf_exit_misc_wq(); + adf_exit_aer(); + adf_exit_vf_wq(); +@@ -453,7 +52,6 @@ static void __exit adf_unregister_ctl_de + qat_crypto_unregister(); + qat_compression_unregister(); + adf_clean_vf_map(false); +- mutex_destroy(&adf_ctl_lock); + } + + module_init(adf_register_ctl_device_driver); +--- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c +@@ -45,19 +45,6 @@ static struct vf_id_map *adf_find_vf(u32 + return NULL; + } + +-static int adf_get_vf_real_id(u32 fake) +-{ +- struct list_head *itr; +- +- list_for_each(itr, &vfs_table) { +- struct vf_id_map *ptr = +- list_entry(itr, struct vf_id_map, list); +- if (ptr->fake_id == fake) +- return ptr->id; +- } +- return -1; +-} +- + /** + * adf_clean_vf_map() - Cleans VF id mappings + * @vf: flag indicating whether mappings is cleaned +@@ -314,63 +301,6 @@ struct adf_accel_dev *adf_devmgr_pci_to_ + } + EXPORT_SYMBOL_GPL(adf_devmgr_pci_to_accel_dev); + +-struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id) +-{ +- struct list_head *itr; +- int real_id; +- +- mutex_lock(&table_lock); +- real_id = adf_get_vf_real_id(id); +- if (real_id < 0) +- goto unlock; +- +- id = real_id; +- +- list_for_each(itr, &accel_table) { +- struct adf_accel_dev *ptr = +- list_entry(itr, struct adf_accel_dev, list); +- if (ptr->accel_id == id) { +- mutex_unlock(&table_lock); +- return ptr; +- } +- } +-unlock: +- mutex_unlock(&table_lock); +- return NULL; +-} +- +-int adf_devmgr_verify_id(u32 id) +-{ +- if (id == ADF_CFG_ALL_DEVICES) +- return 0; +- +- if (adf_devmgr_get_dev_by_id(id)) +- return 0; +- +- return -ENODEV; +-} +- +-static int adf_get_num_dettached_vfs(void) +-{ +- struct list_head *itr; +- int vfs = 0; +- +- mutex_lock(&table_lock); +- list_for_each(itr, &vfs_table) { +- struct vf_id_map *ptr = +- list_entry(itr, struct vf_id_map, list); +- if (ptr->bdf != ~0 && !ptr->attached) +- vfs++; +- } +- mutex_unlock(&table_lock); +- return vfs; +-} +- +-void adf_devmgr_get_num_dev(u32 *num) +-{ +- *num = num_devices - adf_get_num_dettached_vfs(); +-} +- + /** + * adf_dev_in_use() - Check whether accel_dev is currently in use + * @accel_dev: Pointer to acceleration device. diff --git a/queue-6.12/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch b/queue-6.12/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch new file mode 100644 index 0000000000..de090a6ec1 --- /dev/null +++ b/queue-6.12/crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch @@ -0,0 +1,54 @@ +From stable+bounces-268565-greg=kroah.com@vger.kernel.org Thu Jun 25 16:12:02 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 10:08:44 -0400 +Subject: crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() +To: stable@vger.kernel.org +Cc: Thorsten Blum , Herbert Xu , Sasha Levin +Message-ID: <20260625140846.2431963-3-sashal@kernel.org> + +From: Thorsten Blum + +[ Upstream commit 1e26339703e2afd397037defa798682b2b93dcc0 ] + +Replace kzalloc() followed by copy_from_user() with memdup_user() to +improve and simplify adf_ctl_alloc_resources(). memdup_user() returns +either -ENOMEM or -EFAULT (instead of -EIO) if an error occurs. + +Remove the unnecessary device id initialization, since memdup_user() +(like copy_from_user()) immediately overwrites it. + +No functional changes intended other than returning the more idiomatic +error code -EFAULT. + +Signed-off-by: Thorsten Blum +Signed-off-by: Herbert Xu +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c +@@ -94,17 +94,10 @@ static int adf_ctl_alloc_resources(struc + { + struct adf_user_cfg_ctl_data *cfg_data; + +- cfg_data = kzalloc(sizeof(*cfg_data), GFP_KERNEL); +- if (!cfg_data) +- return -ENOMEM; +- +- /* Initialize device id to NO DEVICE as 0 is a valid device id */ +- cfg_data->device_id = ADF_CFG_NO_DEVICE; +- +- if (copy_from_user(cfg_data, (void __user *)arg, sizeof(*cfg_data))) { ++ cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); ++ if (IS_ERR(cfg_data)) { + pr_err("QAT: failed to copy from user cfg_data.\n"); +- kfree(cfg_data); +- return -EIO; ++ return PTR_ERR(cfg_data); + } + + *ctl_data = cfg_data; diff --git a/queue-6.12/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch b/queue-6.12/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch new file mode 100644 index 0000000000..1c8a1427b6 --- /dev/null +++ b/queue-6.12/crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch @@ -0,0 +1,123 @@ +From stable+bounces-268567-greg=kroah.com@vger.kernel.org Thu Jun 25 16:17:30 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 10:08:45 -0400 +Subject: crypto: qat - Return pointer directly in adf_ctl_alloc_resources +To: stable@vger.kernel.org +Cc: Herbert Xu , Thorsten Blum , Giovanni Cabiddu , Sasha Levin +Message-ID: <20260625140846.2431963-4-sashal@kernel.org> + +From: Herbert Xu + +[ Upstream commit 5ce9891ea928208a915411ce8227f8c3e37e5ad9 ] + +Returning values through arguments is confusing and that has +upset the compiler with the recent change to memdup_user: + +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:308:26: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 308 | ctl_data->device_id); + | ^~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:294:39: note: ‘ctl_data’ was declared here + 294 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ +In function ‘adf_ctl_ioctl_dev_stop’, + inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:386:9: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:273:48: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 273 | ret = adf_ctl_is_device_in_use(ctl_data->device_id); + | ~~~~~~~~^~~~~~~~~~~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:261:39: note: ‘ctl_data’ was declared here + 261 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ +In function ‘adf_ctl_ioctl_dev_config’, + inlined from ‘adf_ctl_ioctl’ at ../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:382:9: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:192:54: warning: ‘ctl_data’ may be used uninitialized [-Wmaybe-uninitialized] + 192 | accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); + | ~~~~~~~~^~~~~~~~~~~ +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c: In function ‘adf_ctl_ioctl’: +../drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c:185:39: note: ‘ctl_data’ was declared here + 185 | struct adf_user_cfg_ctl_data *ctl_data; + | ^~~~~~~~ + +Fix this by returning the pointer directly. + +Signed-off-by: Herbert Xu +Reviewed-by: Thorsten Blum +Acked-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 31 +++++++++------------- + 1 file changed, 13 insertions(+), 18 deletions(-) + +--- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c +@@ -89,19 +89,14 @@ err_chrdev_unreg: + return -EFAULT; + } + +-static int adf_ctl_alloc_resources(struct adf_user_cfg_ctl_data **ctl_data, +- unsigned long arg) ++static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg) + { + struct adf_user_cfg_ctl_data *cfg_data; + + cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); +- if (IS_ERR(cfg_data)) { ++ if (IS_ERR(cfg_data)) + pr_err("QAT: failed to copy from user cfg_data.\n"); +- return PTR_ERR(cfg_data); +- } +- +- *ctl_data = cfg_data; +- return 0; ++ return cfg_data; + } + + static int adf_add_key_value_data(struct adf_accel_dev *accel_dev, +@@ -181,13 +176,13 @@ out_err: + static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd, + unsigned long arg) + { +- int ret; + struct adf_user_cfg_ctl_data *ctl_data; + struct adf_accel_dev *accel_dev; ++ int ret = 0; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); + if (!accel_dev) { +@@ -260,9 +255,9 @@ static int adf_ctl_ioctl_dev_stop(struct + int ret; + struct adf_user_cfg_ctl_data *ctl_data; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + if (adf_devmgr_verify_id(ctl_data->device_id)) { + pr_err("QAT: Device %d not found\n", ctl_data->device_id); +@@ -294,9 +289,9 @@ static int adf_ctl_ioctl_dev_start(struc + struct adf_user_cfg_ctl_data *ctl_data; + struct adf_accel_dev *accel_dev; + +- ret = adf_ctl_alloc_resources(&ctl_data, arg); +- if (ret) +- return ret; ++ ctl_data = adf_ctl_alloc_resources(arg); ++ if (IS_ERR(ctl_data)) ++ return PTR_ERR(ctl_data); + + ret = -ENODEV; + accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); diff --git a/queue-6.12/documentation-ioctl-number-extend-include-file-column-width.patch b/queue-6.12/documentation-ioctl-number-extend-include-file-column-width.patch new file mode 100644 index 0000000000..738af3953f --- /dev/null +++ b/queue-6.12/documentation-ioctl-number-extend-include-file-column-width.patch @@ -0,0 +1,603 @@ +From stable+bounces-268566-greg=kroah.com@vger.kernel.org Thu Jun 25 16:16:21 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 10:08:43 -0400 +Subject: Documentation: ioctl-number: Extend "Include File" column width +To: stable@vger.kernel.org +Cc: Bagas Sanjaya , Haren Myneni , Madhavan Srinivasan , Jonathan Corbet , Sasha Levin +Message-ID: <20260625140846.2431963-2-sashal@kernel.org> + +From: Bagas Sanjaya + +[ Upstream commit 15afd5def819e4df2a29cef6fcfa6ae7ba167c0f ] + +Extend width of "Include File" column to fit full path to +papr-physical-attestation.h in later commit. + +Reviewed-by: Haren Myneni +Signed-off-by: Bagas Sanjaya +Acked-by: Madhavan Srinivasan +Signed-off-by: Jonathan Corbet +Link: https://lore.kernel.org/r/20250714015711.14525-3-bagasdotme@gmail.com +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/userspace-api/ioctl/ioctl-number.rst | 486 ++++++++++----------- + 1 file changed, 243 insertions(+), 243 deletions(-) + +--- a/Documentation/userspace-api/ioctl/ioctl-number.rst ++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst +@@ -66,330 +66,330 @@ This table lists ioctls visible from use + most drivers up to 2.6.31, but I know I am missing some. There has been + no attempt to list non-X86 architectures or ioctls from drivers/staging/. + +-==== ===== ======================================================= ================================================================ +-Code Seq# Include File Comments ++==== ===== ========================================================= ================================================================ ++Code Seq# Include File Comments + (hex) +-==== ===== ======================================================= ================================================================ +-0x00 00-1F linux/fs.h conflict! +-0x00 00-1F scsi/scsi_ioctl.h conflict! +-0x00 00-1F linux/fb.h conflict! +-0x00 00-1F linux/wavefront.h conflict! ++==== ===== ========================================================= ================================================================ ++0x00 00-1F linux/fs.h conflict! ++0x00 00-1F scsi/scsi_ioctl.h conflict! ++0x00 00-1F linux/fb.h conflict! ++0x00 00-1F linux/wavefront.h conflict! + 0x02 all linux/fd.h + 0x03 all linux/hdreg.h +-0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these. ++0x04 D2-DC linux/umsdos_fs.h Dead since 2.6.11, but don't reuse these. + 0x06 all linux/lp.h + 0x07 9F-D0 linux/vmw_vmci_defs.h, uapi/linux/vm_sockets.h + 0x09 all linux/raid/md_u.h + 0x10 00-0F drivers/char/s390/vmcp.h + 0x10 10-1F arch/s390/include/uapi/sclp_ctl.h + 0x10 20-2F arch/s390/include/uapi/asm/hypfs.h +-0x12 all linux/fs.h BLK* ioctls ++0x12 all linux/fs.h BLK* ioctls + linux/blkpg.h +-0x15 all linux/fs.h FS_IOC_* ioctls +-0x1b all InfiniBand Subsystem +- ++0x15 all linux/fs.h FS_IOC_* ioctls ++0x1b all InfiniBand Subsystem ++ + 0x20 all drivers/cdrom/cm206.h + 0x22 all scsi/sg.h +-0x3E 00-0F linux/counter.h ++0x3E 00-0F linux/counter.h + '!' 00-1F uapi/linux/seccomp.h +-'#' 00-3F IEEE 1394 Subsystem +- Block for the entire subsystem ++'#' 00-3F IEEE 1394 Subsystem ++ Block for the entire subsystem + '$' 00-0F linux/perf_counter.h, linux/perf_event.h +-'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem +- ++'%' 00-0F include/uapi/linux/stm.h System Trace Module subsystem ++ + '&' 00-07 drivers/firewire/nosy-user.h +-'*' 00-1F uapi/linux/user_events.h User Events Subsystem +- +-'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl +- ++'*' 00-1F uapi/linux/user_events.h User Events Subsystem ++ ++'1' 00-1F linux/timepps.h PPS kit from Ulrich Windl ++ + '2' 01-04 linux/i2o.h +-'3' 00-0F drivers/s390/char/raw3270.h conflict! +-'3' 00-1F linux/suspend_ioctls.h, conflict! ++'3' 00-0F drivers/s390/char/raw3270.h conflict! ++'3' 00-1F linux/suspend_ioctls.h, conflict! + kernel/power/user.c +-'8' all SNP8023 advanced NIC card +- ++'8' all SNP8023 advanced NIC card ++ + ';' 64-7F linux/vfio.h + ';' 80-FF linux/iommufd.h +-'=' 00-3f uapi/linux/ptp_clock.h +-'@' 00-0F linux/radeonfb.h conflict! +-'@' 00-0F drivers/video/aty/aty128fb.c conflict! +-'A' 00-1F linux/apm_bios.h conflict! +-'A' 00-0F linux/agpgart.h, conflict! ++'=' 00-3f uapi/linux/ptp_clock.h ++'@' 00-0F linux/radeonfb.h conflict! ++'@' 00-0F drivers/video/aty/aty128fb.c conflict! ++'A' 00-1F linux/apm_bios.h conflict! ++'A' 00-0F linux/agpgart.h, conflict! + drivers/char/agp/compat_ioctl.h +-'A' 00-7F sound/asound.h conflict! +-'B' 00-1F linux/cciss_ioctl.h conflict! +-'B' 00-0F include/linux/pmu.h conflict! +-'B' C0-FF advanced bbus +-'B' 00-0F xen/xenbus_dev.h conflict! +-'C' all linux/soundcard.h conflict! +-'C' 01-2F linux/capi.h conflict! +-'C' F0-FF drivers/net/wan/cosa.h conflict! ++'A' 00-7F sound/asound.h conflict! ++'B' 00-1F linux/cciss_ioctl.h conflict! ++'B' 00-0F include/linux/pmu.h conflict! ++'B' C0-FF advanced bbus ++'B' 00-0F xen/xenbus_dev.h conflict! ++'C' all linux/soundcard.h conflict! ++'C' 01-2F linux/capi.h conflict! ++'C' F0-FF drivers/net/wan/cosa.h conflict! + 'D' all arch/s390/include/asm/dasd.h +-'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h Dead since 2022 ++'D' 40-5F drivers/scsi/dpt/dtpi_ioctl.h Dead since 2022 + 'D' 05 drivers/scsi/pmcraid.h +-'E' all linux/input.h conflict! +-'E' 00-0F xen/evtchn.h conflict! +-'F' all linux/fb.h conflict! +-'F' 01-02 drivers/scsi/pmcraid.h conflict! +-'F' 20 drivers/video/fsl-diu-fb.h conflict! +-'F' 20 linux/ivtvfb.h conflict! +-'F' 20 linux/matroxfb.h conflict! +-'F' 20 drivers/video/aty/atyfb_base.c conflict! +-'F' 00-0F video/da8xx-fb.h conflict! +-'F' 80-8F linux/arcfb.h conflict! +-'F' DD video/sstfb.h conflict! +-'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict! +-'G' 00-0F xen/gntalloc.h, xen/gntdev.h conflict! +-'H' 00-7F linux/hiddev.h conflict! +-'H' 00-0F linux/hidraw.h conflict! +-'H' 01 linux/mei.h conflict! +-'H' 02 linux/mei.h conflict! +-'H' 03 linux/mei.h conflict! +-'H' 00-0F sound/asound.h conflict! +-'H' 20-40 sound/asound_fm.h conflict! +-'H' 80-8F sound/sfnt_info.h conflict! +-'H' 10-8F sound/emu10k1.h conflict! +-'H' 10-1F sound/sb16_csp.h conflict! +-'H' 10-1F sound/hda_hwdep.h conflict! +-'H' 40-4F sound/hdspm.h conflict! +-'H' 40-4F sound/hdsp.h conflict! ++'E' all linux/input.h conflict! ++'E' 00-0F xen/evtchn.h conflict! ++'F' all linux/fb.h conflict! ++'F' 01-02 drivers/scsi/pmcraid.h conflict! ++'F' 20 drivers/video/fsl-diu-fb.h conflict! ++'F' 20 linux/ivtvfb.h conflict! ++'F' 20 linux/matroxfb.h conflict! ++'F' 20 drivers/video/aty/atyfb_base.c conflict! ++'F' 00-0F video/da8xx-fb.h conflict! ++'F' 80-8F linux/arcfb.h conflict! ++'F' DD video/sstfb.h conflict! ++'G' 00-3F drivers/misc/sgi-gru/grulib.h conflict! ++'G' 00-0F xen/gntalloc.h, xen/gntdev.h conflict! ++'H' 00-7F linux/hiddev.h conflict! ++'H' 00-0F linux/hidraw.h conflict! ++'H' 01 linux/mei.h conflict! ++'H' 02 linux/mei.h conflict! ++'H' 03 linux/mei.h conflict! ++'H' 00-0F sound/asound.h conflict! ++'H' 20-40 sound/asound_fm.h conflict! ++'H' 80-8F sound/sfnt_info.h conflict! ++'H' 10-8F sound/emu10k1.h conflict! ++'H' 10-1F sound/sb16_csp.h conflict! ++'H' 10-1F sound/hda_hwdep.h conflict! ++'H' 40-4F sound/hdspm.h conflict! ++'H' 40-4F sound/hdsp.h conflict! + 'H' 90 sound/usb/usx2y/usb_stream.h +-'H' 00-0F uapi/misc/habanalabs.h conflict! ++'H' 00-0F uapi/misc/habanalabs.h conflict! + 'H' A0 uapi/linux/usb/cdc-wdm.h +-'H' C0-F0 net/bluetooth/hci.h conflict! +-'H' C0-DF net/bluetooth/hidp/hidp.h conflict! +-'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict! +-'H' C0-DF net/bluetooth/bnep/bnep.h conflict! +-'H' F1 linux/hid-roccat.h ++'H' C0-F0 net/bluetooth/hci.h conflict! ++'H' C0-DF net/bluetooth/hidp/hidp.h conflict! ++'H' C0-DF net/bluetooth/cmtp/cmtp.h conflict! ++'H' C0-DF net/bluetooth/bnep/bnep.h conflict! ++'H' F1 linux/hid-roccat.h + 'H' F8-FA sound/firewire.h +-'I' all linux/isdn.h conflict! +-'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict! +-'I' 40-4F linux/mISDNif.h conflict! ++'I' all linux/isdn.h conflict! ++'I' 00-0F drivers/isdn/divert/isdn_divert.h conflict! ++'I' 40-4F linux/mISDNif.h conflict! + 'K' all linux/kd.h +-'L' 00-1F linux/loop.h conflict! +-'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict! +-'L' E0-FF linux/ppdd.h encrypted disk device driver +- +-'M' all linux/soundcard.h conflict! +-'M' 01-16 mtd/mtd-abi.h conflict! ++'L' 00-1F linux/loop.h conflict! ++'L' 10-1F drivers/scsi/mpt3sas/mpt3sas_ctl.h conflict! ++'L' E0-FF linux/ppdd.h encrypted disk device driver ++ ++'M' all linux/soundcard.h conflict! ++'M' 01-16 mtd/mtd-abi.h conflict! + and drivers/mtd/mtdchar.c + 'M' 01-03 drivers/scsi/megaraid/megaraid_sas.h +-'M' 00-0F drivers/video/fsl-diu-fb.h conflict! ++'M' 00-0F drivers/video/fsl-diu-fb.h conflict! + 'N' 00-1F drivers/usb/scanner.h + 'N' 40-7F drivers/block/nvme.c +-'N' 80-8F uapi/linux/ntsync.h NT synchronization primitives +- +-'O' 00-06 mtd/ubi-user.h UBI +-'P' all linux/soundcard.h conflict! +-'P' 60-6F sound/sscape_ioctl.h conflict! +-'P' 00-0F drivers/usb/class/usblp.c conflict! +-'P' 01-09 drivers/misc/pci_endpoint_test.c conflict! +-'P' 00-0F xen/privcmd.h conflict! +-'P' 00-05 linux/tps6594_pfsm.h conflict! ++'N' 80-8F uapi/linux/ntsync.h NT synchronization primitives ++ ++'O' 00-06 mtd/ubi-user.h UBI ++'P' all linux/soundcard.h conflict! ++'P' 60-6F sound/sscape_ioctl.h conflict! ++'P' 00-0F drivers/usb/class/usblp.c conflict! ++'P' 01-09 drivers/misc/pci_endpoint_test.c conflict! ++'P' 00-0F xen/privcmd.h conflict! ++'P' 00-05 linux/tps6594_pfsm.h conflict! + 'Q' all linux/soundcard.h +-'R' 00-1F linux/random.h conflict! +-'R' 01 linux/rfkill.h conflict! ++'R' 00-1F linux/random.h conflict! ++'R' 01 linux/rfkill.h conflict! + 'R' 20-2F linux/trace_mmap.h + 'R' C0-DF net/bluetooth/rfcomm.h + 'R' E0 uapi/linux/fsl_mc.h +-'S' all linux/cdrom.h conflict! +-'S' 80-81 scsi/scsi_ioctl.h conflict! +-'S' 82-FF scsi/scsi.h conflict! +-'S' 00-7F sound/asequencer.h conflict! +-'T' all linux/soundcard.h conflict! +-'T' 00-AF sound/asound.h conflict! +-'T' all arch/x86/include/asm/ioctls.h conflict! +-'T' C0-DF linux/if_tun.h conflict! +-'U' all sound/asound.h conflict! +-'U' 00-CF linux/uinput.h conflict! ++'S' all linux/cdrom.h conflict! ++'S' 80-81 scsi/scsi_ioctl.h conflict! ++'S' 82-FF scsi/scsi.h conflict! ++'S' 00-7F sound/asequencer.h conflict! ++'T' all linux/soundcard.h conflict! ++'T' 00-AF sound/asound.h conflict! ++'T' all arch/x86/include/asm/ioctls.h conflict! ++'T' C0-DF linux/if_tun.h conflict! ++'U' all sound/asound.h conflict! ++'U' 00-CF linux/uinput.h conflict! + 'U' 00-EF linux/usbdevice_fs.h + 'U' C0-CF drivers/bluetooth/hci_uart.h +-'V' all linux/vt.h conflict! +-'V' all linux/videodev2.h conflict! +-'V' C0 linux/ivtvfb.h conflict! +-'V' C0 linux/ivtv.h conflict! +-'V' C0 media/si4713.h conflict! +-'W' 00-1F linux/watchdog.h conflict! +-'W' 00-1F linux/wanrouter.h conflict! (pre 3.9) +-'W' 00-3F sound/asound.h conflict! ++'V' all linux/vt.h conflict! ++'V' all linux/videodev2.h conflict! ++'V' C0 linux/ivtvfb.h conflict! ++'V' C0 linux/ivtv.h conflict! ++'V' C0 media/si4713.h conflict! ++'W' 00-1F linux/watchdog.h conflict! ++'W' 00-1F linux/wanrouter.h conflict! (pre 3.9) ++'W' 00-3F sound/asound.h conflict! + 'W' 40-5F drivers/pci/switch/switchtec.c + 'W' 60-61 linux/watch_queue.h +-'X' all fs/xfs/xfs_fs.h, conflict! ++'X' all fs/xfs/xfs_fs.h, conflict! + fs/xfs/linux-2.6/xfs_ioctl32.h, + include/linux/falloc.h, + linux/fs.h, +-'X' all fs/ocfs2/ocfs_fs.h conflict! +-'X' 01 linux/pktcdvd.h conflict! ++'X' all fs/ocfs2/ocfs_fs.h conflict! ++'X' 01 linux/pktcdvd.h conflict! + 'Z' 14-15 drivers/message/fusion/mptctl.h +-'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices +- +-'a' all linux/atm*.h, linux/sonet.h ATM on linux +- +-'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver +-'b' 00-FF conflict! bit3 vme host bridge +- +-'b' 00-0F linux/dma-buf.h conflict! +-'c' 00-7F linux/comstats.h conflict! +-'c' 00-7F linux/coda.h conflict! +-'c' 00-1F linux/chio.h conflict! +-'c' 80-9F arch/s390/include/asm/chsc.h conflict! ++'[' 00-3F linux/usb/tmc.h USB Test and Measurement Devices ++ ++'a' all linux/atm*.h, linux/sonet.h ATM on linux ++ ++'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver ++'b' 00-FF conflict! bit3 vme host bridge ++ ++'b' 00-0F linux/dma-buf.h conflict! ++'c' 00-7F linux/comstats.h conflict! ++'c' 00-7F linux/coda.h conflict! ++'c' 00-1F linux/chio.h conflict! ++'c' 80-9F arch/s390/include/asm/chsc.h conflict! + 'c' A0-AF arch/x86/include/asm/msr.h conflict! +-'d' 00-FF linux/char/drm/drm.h conflict! +-'d' 02-40 pcmcia/ds.h conflict! ++'d' 00-FF linux/char/drm/drm.h conflict! ++'d' 02-40 pcmcia/ds.h conflict! + 'd' F0-FF linux/digi1.h +-'e' all linux/digi1.h conflict! +-'f' 00-1F linux/ext2_fs.h conflict! +-'f' 00-1F linux/ext3_fs.h conflict! +-'f' 00-0F fs/jfs/jfs_dinode.h conflict! +-'f' 00-0F fs/ext4/ext4.h conflict! +-'f' 00-0F linux/fs.h conflict! +-'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict! ++'e' all linux/digi1.h conflict! ++'f' 00-1F linux/ext2_fs.h conflict! ++'f' 00-1F linux/ext3_fs.h conflict! ++'f' 00-0F fs/jfs/jfs_dinode.h conflict! ++'f' 00-0F fs/ext4/ext4.h conflict! ++'f' 00-0F linux/fs.h conflict! ++'f' 00-0F fs/ocfs2/ocfs2_fs.h conflict! + 'f' 13-27 linux/fscrypt.h + 'f' 81-8F linux/fsverity.h + 'g' 00-0F linux/usb/gadgetfs.h + 'g' 20-2F linux/usb/g_printer.h +-'h' 00-7F conflict! Charon filesystem +- +-'h' 00-1F linux/hpet.h conflict! ++'h' 00-7F conflict! Charon filesystem ++ ++'h' 00-1F linux/hpet.h conflict! + 'h' 80-8F fs/hfsplus/ioctl.c +-'i' 00-3F linux/i2o-dev.h conflict! +-'i' 0B-1F linux/ipmi.h conflict! ++'i' 00-3F linux/i2o-dev.h conflict! ++'i' 0B-1F linux/ipmi.h conflict! + 'i' 80-8F linux/i8k.h +-'i' 90-9F `linux/iio/*.h` IIO ++'i' 90-9F `linux/iio/*.h` IIO + 'j' 00-3F linux/joystick.h +-'k' 00-0F linux/spi/spidev.h conflict! +-'k' 00-05 video/kyro.h conflict! +-'k' 10-17 linux/hsi/hsi_char.h HSI character device +-'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system +- +-'l' 40-7F linux/udf_fs_i.h in development: +- +-'m' 00-09 linux/mmtimer.h conflict! +-'m' all linux/mtio.h conflict! +-'m' all linux/soundcard.h conflict! +-'m' all linux/synclink.h conflict! +-'m' 00-19 drivers/message/fusion/mptctl.h conflict! +-'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict! ++'k' 00-0F linux/spi/spidev.h conflict! ++'k' 00-05 video/kyro.h conflict! ++'k' 10-17 linux/hsi/hsi_char.h HSI character device ++'l' 00-3F linux/tcfs_fs.h transparent cryptographic file system ++ ++'l' 40-7F linux/udf_fs_i.h in development: ++ ++'m' 00-09 linux/mmtimer.h conflict! ++'m' all linux/mtio.h conflict! ++'m' all linux/soundcard.h conflict! ++'m' all linux/synclink.h conflict! ++'m' 00-19 drivers/message/fusion/mptctl.h conflict! ++'m' 00 drivers/scsi/megaraid/megaraid_ioctl.h conflict! + 'n' 00-7F linux/ncp_fs.h and fs/ncpfs/ioctl.c +-'n' 80-8F uapi/linux/nilfs2_api.h NILFS2 +-'n' E0-FF linux/matroxfb.h matroxfb +-'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2 +-'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps) +-'o' 40-41 mtd/ubi-user.h UBI +-'o' 01-A1 `linux/dvb/*.h` DVB +-'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this) +-'p' 00-1F linux/rtc.h conflict! ++'n' 80-8F uapi/linux/nilfs2_api.h NILFS2 ++'n' E0-FF linux/matroxfb.h matroxfb ++'o' 00-1F fs/ocfs2/ocfs2_fs.h OCFS2 ++'o' 00-03 mtd/ubi-user.h conflict! (OCFS2 and UBI overlaps) ++'o' 40-41 mtd/ubi-user.h UBI ++'o' 01-A1 `linux/dvb/*.h` DVB ++'p' 00-0F linux/phantom.h conflict! (OpenHaptics needs this) ++'p' 00-1F linux/rtc.h conflict! + 'p' 40-7F linux/nvram.h +-'p' 80-9F linux/ppdev.h user-space parport +- +-'p' A1-A5 linux/pps.h LinuxPPS +- ++'p' 80-9F linux/ppdev.h user-space parport ++ ++'p' A1-A5 linux/pps.h LinuxPPS ++ + 'q' 00-1F linux/serio.h +-'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK +- linux/ixjuser.h ++'q' 80-FF linux/telephony.h Internet PhoneJACK, Internet LineJACK ++ linux/ixjuser.h + 'r' 00-1F linux/msdos_fs.h and fs/fat/dir.c + 's' all linux/cdk.h + 't' 00-7F linux/ppp-ioctl.h + 't' 80-8F linux/isdn_ppp.h +-'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM +-'u' 00-1F linux/smb_fs.h gone +-'u' 00-2F linux/ublk_cmd.h conflict! +-'u' 20-3F linux/uvcvideo.h USB video class host driver +-'u' 40-4f linux/udmabuf.h userspace dma-buf misc device +-'v' 00-1F linux/ext2_fs.h conflict! +-'v' 00-1F linux/fs.h conflict! +-'v' 00-0F linux/sonypi.h conflict! +-'v' 00-0F media/v4l2-subdev.h conflict! +-'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API +-'v' C0-FF linux/meye.h conflict! +-'w' all CERN SCI driver +-'y' 00-1F packet based user level communications +- +-'z' 00-3F CAN bus card conflict! +- +-'z' 40-7F CAN bus card conflict! +- +-'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict! ++'t' 90-91 linux/toshiba.h toshiba and toshiba_acpi SMM ++'u' 00-1F linux/smb_fs.h gone ++'u' 00-2F linux/ublk_cmd.h conflict! ++'u' 20-3F linux/uvcvideo.h USB video class host driver ++'u' 40-4f linux/udmabuf.h userspace dma-buf misc device ++'v' 00-1F linux/ext2_fs.h conflict! ++'v' 00-1F linux/fs.h conflict! ++'v' 00-0F linux/sonypi.h conflict! ++'v' 00-0F media/v4l2-subdev.h conflict! ++'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API ++'v' C0-FF linux/meye.h conflict! ++'w' all CERN SCI driver ++'y' 00-1F packet based user level communications ++ ++'z' 00-3F CAN bus card conflict! ++ ++'z' 40-7F CAN bus card conflict! ++ ++'z' 10-4F drivers/s390/crypto/zcrypt_api.h conflict! + '|' 00-7F linux/media.h + 0x80 00-1F linux/fb.h + 0x81 00-1F linux/vduse.h + 0x89 00-06 arch/x86/include/asm/sockios.h + 0x89 0B-DF linux/sockios.h +-0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range +-0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range ++0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range ++0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range + 0x8A 00-1F linux/eventpoll.h + 0x8B all linux/wireless.h +-0x8C 00-3F WiNRADiO driver +- ++0x8C 00-3F WiNRADiO driver ++ + 0x90 00 drivers/cdrom/sbpcd.h + 0x92 00-0F drivers/usb/mon/mon_bin.c + 0x93 60-7F linux/auto_fs.h +-0x94 all fs/btrfs/ioctl.h Btrfs filesystem +- and linux/fs.h some lifted to vfs/generic +-0x97 00-7F fs/ceph/ioctl.h Ceph file system +-0x99 00-0F 537-Addinboard driver +- +-0xA0 all linux/sdp/sdp.h Industrial Device Project +- +-0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver +-0xA2 all uapi/linux/acrn.h ACRN hypervisor +-0xA3 80-8F Port ACL in development: +- ++0x94 all fs/btrfs/ioctl.h Btrfs filesystem ++ and linux/fs.h some lifted to vfs/generic ++0x97 00-7F fs/ceph/ioctl.h Ceph file system ++0x99 00-0F 537-Addinboard driver ++ ++0xA0 all linux/sdp/sdp.h Industrial Device Project ++ ++0xA1 0 linux/vtpm_proxy.h TPM Emulator Proxy Driver ++0xA2 all uapi/linux/acrn.h ACRN hypervisor ++0xA3 80-8F Port ACL in development: ++ + 0xA3 90-9F linux/dtlk.h +-0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem +-0xA4 00-1F uapi/asm/sgx.h +-0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator +- +-0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver +- ++0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem ++0xA4 00-1F uapi/asm/sgx.h ++0xA5 01-05 linux/surface_aggregator/cdev.h Microsoft Surface Platform System Aggregator ++ ++0xA5 20-2F linux/surface_aggregator/dtx.h Microsoft Surface DTX driver ++ + 0xAA 00-3F linux/uapi/linux/userfaultfd.h + 0xAB 00-1F linux/nbd.h + 0xAC 00-1F linux/raw.h +-0xAD 00 Netfilter device in development: +- +-0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine +- +-0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine +- +-0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves +-0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor +-0xB0 all RATIO devices in development: +- +-0xB1 00-1F PPPoX +- +-0xB2 00 arch/powerpc/include/uapi/asm/papr-vpd.h powerpc/pseries VPD API +- +-0xB2 01-02 arch/powerpc/include/uapi/asm/papr-sysparm.h powerpc/pseries system parameter API +- ++0xAD 00 Netfilter device in development: ++ ++0xAE 00-1F linux/kvm.h Kernel-based Virtual Machine ++ ++0xAE 40-FF linux/kvm.h Kernel-based Virtual Machine ++ ++0xAE 20-3F linux/nitro_enclaves.h Nitro Enclaves ++0xAF 00-1F linux/fsl_hypervisor.h Freescale hypervisor ++0xB0 all RATIO devices in development: ++ ++0xB1 00-1F PPPoX ++ ++0xB2 00 arch/powerpc/include/uapi/asm/papr-vpd.h powerpc/pseries VPD API ++ ++0xB2 01-02 arch/powerpc/include/uapi/asm/papr-sysparm.h powerpc/pseries system parameter API ++ + 0xB3 00 linux/mmc/ioctl.h +-0xB4 00-0F linux/gpio.h +-0xB5 00-0F uapi/linux/rpmsg.h ++0xB4 00-0F linux/gpio.h ++0xB5 00-0F uapi/linux/rpmsg.h + 0xB6 all linux/fpga-dfl.h +-0xB7 all uapi/linux/remoteproc_cdev.h +-0xB7 all uapi/linux/nsfs.h > +-0xB8 01-02 uapi/misc/mrvl_cn10k_dpi.h Marvell CN10K DPI driver ++0xB7 all uapi/linux/remoteproc_cdev.h ++0xB7 all uapi/linux/nsfs.h > ++0xB8 01-02 uapi/misc/mrvl_cn10k_dpi.h Marvell CN10K DPI driver + 0xC0 00-0F linux/usb/iowarrior.h + 0xCA 00-0F uapi/misc/cxl.h + 0xCA 10-2F uapi/misc/ocxl.h + 0xCA 80-BF uapi/scsi/cxlflash_ioctl.h +-0xCB 00-1F CBM serial IEC bus in development: +- +-0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver ++0xCB 00-1F CBM serial IEC bus in development: ++ ++0xCC 00-0F drivers/misc/ibmvmc.h pseries VMC driver + 0xCD 01 linux/reiserfs_fs.h +-0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices ++0xCE 01-02 uapi/linux/cxl_mem.h Compute Express Link Memory Devices + 0xCF 02 fs/smb/client/cifs_ioctl.h + 0xDB 00-0F drivers/char/mwave/mwavepub.h +-0xDD 00-3F ZFCP device driver see drivers/s390/scsi/ +- ++0xDD 00-3F ZFCP device driver see drivers/s390/scsi/ ++ + 0xE5 00-3F linux/fuse.h +-0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver +-0xEE 00-09 uapi/linux/pfrut.h Platform Firmware Runtime Update and Telemetry +-0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development) +- +-0xF6 all LTTng Linux Trace Toolkit Next Generation +- +-0xF8 all arch/x86/include/uapi/asm/amd_hsmp.h AMD HSMP EPYC system management interface driver +- ++0xEC 00-01 drivers/platform/chrome/cros_ec_dev.h ChromeOS EC driver ++0xEE 00-09 uapi/linux/pfrut.h Platform Firmware Runtime Update and Telemetry ++0xF3 00-3F drivers/usb/misc/sisusbvga/sisusb.h sisfb (in development) ++ ++0xF6 all LTTng Linux Trace Toolkit Next Generation ++ ++0xF8 all arch/x86/include/uapi/asm/amd_hsmp.h AMD HSMP EPYC system management interface driver ++ + 0xFD all linux/dm-ioctl.h + 0xFE all linux/isst_if.h +-==== ===== ======================================================= ================================================================ ++==== ===== ========================================================= ================================================================ diff --git a/queue-6.12/documentation-ioctl-number-fix-linuxppc-dev-mailto-link.patch b/queue-6.12/documentation-ioctl-number-fix-linuxppc-dev-mailto-link.patch new file mode 100644 index 0000000000..b8114ea312 --- /dev/null +++ b/queue-6.12/documentation-ioctl-number-fix-linuxppc-dev-mailto-link.patch @@ -0,0 +1,41 @@ +From stable+bounces-268564-greg=kroah.com@vger.kernel.org Thu Jun 25 16:16:13 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 10:08:42 -0400 +Subject: Documentation: ioctl-number: Fix linuxppc-dev mailto link +To: stable@vger.kernel.org +Cc: Bagas Sanjaya , Haren Myneni , Madhavan Srinivasan , Jonathan Corbet , Sasha Levin +Message-ID: <20260625140846.2431963-1-sashal@kernel.org> + +From: Bagas Sanjaya + +[ Upstream commit 3dfa97bd93614c15418ba7b5c727f6c5bb617174 ] + +Spell out full Linux PPC mailing list address like other subsystem +mailing lists listed in the table. + +Reviewed-by: Haren Myneni +Signed-off-by: Bagas Sanjaya +Acked-by: Madhavan Srinivasan +Signed-off-by: Jonathan Corbet +Link: https://lore.kernel.org/r/20250714015711.14525-2-bagasdotme@gmail.com +Stable-dep-of: d237230728c5 ("crypto: qat - remove unused character device and IOCTLs") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/userspace-api/ioctl/ioctl-number.rst | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/Documentation/userspace-api/ioctl/ioctl-number.rst ++++ b/Documentation/userspace-api/ioctl/ioctl-number.rst +@@ -358,9 +358,9 @@ Code Seq# Include File + 0xB1 00-1F PPPoX + + 0xB2 00 arch/powerpc/include/uapi/asm/papr-vpd.h powerpc/pseries VPD API +- ++ + 0xB2 01-02 arch/powerpc/include/uapi/asm/papr-sysparm.h powerpc/pseries system parameter API +- ++ + 0xB3 00 linux/mmc/ioctl.h + 0xB4 00-0F linux/gpio.h + 0xB5 00-0F uapi/linux/rpmsg.h diff --git a/queue-6.12/drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch b/queue-6.12/drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch new file mode 100644 index 0000000000..0bf8aa397f --- /dev/null +++ b/queue-6.12/drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch @@ -0,0 +1,58 @@ +From stable+bounces-268562-greg=kroah.com@vger.kernel.org Thu Jun 25 16:06:48 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 10:06:04 -0400 +Subject: drivers/base/memory: set mem->altmap after successful device registration +To: stable@vger.kernel.org +Cc: Georgi Djakov , "Oscar Salvador (SUSE)" , Vishal Verma , Mike Rapoport , Richard Cheng , David Hildenbrand , Georgi Djakov , Greg Kroah-Hartman , "Rafael J. Wysocki" , Andrew Morton , Sasha Levin +Message-ID: <20260625140604.2429376-1-sashal@kernel.org> + +From: Georgi Djakov + +[ Upstream commit a2b8d7827f48ee54a686cb80e4a1d0ff954ec42a ] + +If __add_memory_block() fails at xa_store() (under memory pressure for +example), device_unregister() is called, which eventually triggers +memory_block_release() with mem->altmap still set, causing a +WARN_ON(mem->altmap). This was triggered by modifying virtio-mem driver. + +Fix this by delaying the assignment of mem->altmap until after +__add_memory_block() has succeeded. + +Link: https://lore.kernel.org/20260514092657.3057141-1-georgi.djakov@oss.qualcomm.com +Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block") +Signed-off-by: Georgi Djakov +Acked-by: Oscar Salvador (SUSE) +Cc: Vishal Verma +Cc: Mike Rapoport +Cc: Richard Cheng +Cc: David Hildenbrand +Cc: Georgi Djakov +Cc: Greg Kroah-Hartman +Cc: "Rafael J. Wysocki" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/memory.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -794,7 +794,6 @@ static int add_memory_block(unsigned lon + mem->start_section_nr = block_id * sections_per_block; + mem->state = state; + mem->nid = NUMA_NO_NODE; +- mem->altmap = altmap; + INIT_LIST_HEAD(&mem->group_next); + + #ifndef CONFIG_NUMA +@@ -812,6 +811,8 @@ static int add_memory_block(unsigned lon + if (ret) + return ret; + ++ mem->altmap = altmap; ++ + if (group) { + mem->group = group; + list_add(&mem->group_next, &group->memory_blocks); diff --git a/queue-6.12/input-include-export.h-in-modules-using-export_symbol.patch b/queue-6.12/input-include-export.h-in-modules-using-export_symbol.patch new file mode 100644 index 0000000000..53921141c9 --- /dev/null +++ b/queue-6.12/input-include-export.h-in-modules-using-export_symbol.patch @@ -0,0 +1,339 @@ +From stable+bounces-268622-greg=kroah.com@vger.kernel.org Thu Jun 25 18:26:27 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 12:25:07 -0400 +Subject: Input: include export.h in modules using EXPORT_SYMBOL*() +To: stable@vger.kernel.org +Cc: Dmitry Torokhov , Sasha Levin +Message-ID: <20260625162508.2501015-1-sashal@kernel.org> + +From: Dmitry Torokhov + +[ Upstream commit df595059d54383c42607b59f1f9ea74dade280fe ] + +A number of modules in the input subsystem use EXPORT_SYMBOL() and +friends without explicitly including the corresponding header +. While the build currently succeeds due to this header +being pulled in transitively, this is not guaranteed to be the case in +the future. + +Let's add the explicit include to make the dependencies clear and +prevent future build breakage. + +Signed-off-by: Dmitry Torokhov +Stable-dep-of: 0adb483fbf2d ("Input: rmi4 - refactor register descriptor parsing") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/ff-core.c | 2 +- + drivers/input/ff-memless.c | 1 + + drivers/input/gameport/gameport.c | 1 + + drivers/input/input-poller.c | 1 + + drivers/input/input.c | 1 + + drivers/input/joystick/iforce/iforce-main.c | 1 + + drivers/input/joystick/iforce/iforce-packets.c | 1 + + drivers/input/misc/ad714x.c | 1 + + drivers/input/misc/adxl34x.c | 1 + + drivers/input/misc/cma3000_d0x.c | 1 + + drivers/input/rmi4/rmi_2d_sensor.c | 1 + + drivers/input/rmi4/rmi_bus.c | 1 + + drivers/input/rmi4/rmi_driver.c | 1 + + drivers/input/serio/hil_mlc.c | 1 + + drivers/input/serio/hp_sdc.c | 1 + + drivers/input/serio/i8042.c | 1 + + drivers/input/serio/libps2.c | 1 + + drivers/input/serio/serio.c | 1 + + drivers/input/sparse-keymap.c | 1 + + drivers/input/touchscreen.c | 1 + + drivers/input/touchscreen/ad7879.c | 1 + + drivers/input/touchscreen/cyttsp_core.c | 1 + + drivers/input/touchscreen/goodix_berlin_core.c | 1 + + drivers/input/touchscreen/tsc200x-core.c | 1 + + drivers/input/touchscreen/wm9705.c | 1 + + drivers/input/touchscreen/wm9712.c | 1 + + drivers/input/touchscreen/wm9713.c | 1 + + drivers/input/touchscreen/wm97xx-core.c | 1 + + 28 files changed, 28 insertions(+), 1 deletion(-) + +--- a/drivers/input/ff-core.c ++++ b/drivers/input/ff-core.c +@@ -8,9 +8,9 @@ + + /* #define DEBUG */ + ++#include + #include + #include +-#include + #include + #include + #include +--- a/drivers/input/ff-memless.c ++++ b/drivers/input/ff-memless.c +@@ -10,6 +10,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include + #include + #include + #include +--- a/drivers/input/gameport/gameport.c ++++ b/drivers/input/gameport/gameport.c +@@ -9,6 +9,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include + #include + #include + #include +--- a/drivers/input/input-poller.c ++++ b/drivers/input/input-poller.c +@@ -4,6 +4,7 @@ + */ + + #include ++#include + #include + #include + #include +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -8,6 +8,7 @@ + + #define pr_fmt(fmt) KBUILD_BASENAME ": " fmt + ++#include + #include + #include + #include +--- a/drivers/input/joystick/iforce/iforce-main.c ++++ b/drivers/input/joystick/iforce/iforce-main.c +@@ -6,6 +6,7 @@ + * USB/RS232 I-Force joysticks and wheels. + */ + ++#include + #include + #include "iforce.h" + +--- a/drivers/input/joystick/iforce/iforce-packets.c ++++ b/drivers/input/joystick/iforce/iforce-packets.c +@@ -6,6 +6,7 @@ + * USB/RS232 I-Force joysticks and wheels. + */ + ++#include + #include + #include "iforce.h" + +--- a/drivers/input/misc/ad714x.c ++++ b/drivers/input/misc/ad714x.c +@@ -6,6 +6,7 @@ + */ + + #include ++#include + #include + #include + #include +--- a/drivers/input/misc/adxl34x.c ++++ b/drivers/input/misc/adxl34x.c +@@ -9,6 +9,7 @@ + + #include + #include ++#include + #include + #include + #include +--- a/drivers/input/misc/cma3000_d0x.c ++++ b/drivers/input/misc/cma3000_d0x.c +@@ -6,6 +6,7 @@ + * Author: Hemanth V + */ + ++#include + #include + #include + #include +--- a/drivers/input/rmi4/rmi_2d_sensor.c ++++ b/drivers/input/rmi4/rmi_2d_sensor.c +@@ -4,6 +4,7 @@ + * Copyright (c) 2011 Unixphere + */ + ++#include + #include + #include + #include +--- a/drivers/input/rmi4/rmi_bus.c ++++ b/drivers/input/rmi4/rmi_bus.c +@@ -4,6 +4,7 @@ + * Copyright (c) 2011 Unixphere + */ + ++#include + #include + #include + #include +--- a/drivers/input/rmi4/rmi_driver.c ++++ b/drivers/input/rmi4/rmi_driver.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include "rmi_bus.h" + #include "rmi_driver.h" + +--- a/drivers/input/serio/hil_mlc.c ++++ b/drivers/input/serio/hil_mlc.c +@@ -54,6 +54,7 @@ + + #include + #include ++#include + #include + #include + #include +--- a/drivers/input/serio/hp_sdc.c ++++ b/drivers/input/serio/hp_sdc.c +@@ -63,6 +63,7 @@ + + #include + #include ++#include + #include + #include + #include +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -10,6 +10,7 @@ + + #include + #include ++#include + #include + #include + #include +--- a/drivers/input/serio/libps2.c ++++ b/drivers/input/serio/libps2.c +@@ -8,6 +8,7 @@ + + + #include ++#include + #include + #include + #include +--- a/drivers/input/serio/serio.c ++++ b/drivers/input/serio/serio.c +@@ -9,6 +9,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include + #include + #include + #include +--- a/drivers/input/sparse-keymap.c ++++ b/drivers/input/sparse-keymap.c +@@ -10,6 +10,7 @@ + * Copyright (C) 2005 Dmitry Torokhov + */ + ++#include + #include + #include + #include +--- a/drivers/input/touchscreen.c ++++ b/drivers/input/touchscreen.c +@@ -6,6 +6,7 @@ + * Copyright (c) 2014 Sebastian Reichel + */ + ++#include + #include + #include + #include +--- a/drivers/input/touchscreen/ad7879.c ++++ b/drivers/input/touchscreen/ad7879.c +@@ -22,6 +22,7 @@ + + #include + #include ++#include + #include + #include + #include +--- a/drivers/input/touchscreen/cyttsp_core.c ++++ b/drivers/input/touchscreen/cyttsp_core.c +@@ -14,6 +14,7 @@ + */ + + #include ++#include + #include + #include + #include +--- a/drivers/input/touchscreen/goodix_berlin_core.c ++++ b/drivers/input/touchscreen/goodix_berlin_core.c +@@ -24,6 +24,7 @@ + */ + + #include ++#include + #include + #include + #include +--- a/drivers/input/touchscreen/tsc200x-core.c ++++ b/drivers/input/touchscreen/tsc200x-core.c +@@ -10,6 +10,7 @@ + * based on TSC2301 driver by Klaus K. Pedersen + */ + ++#include + #include + #include + #include +--- a/drivers/input/touchscreen/wm9705.c ++++ b/drivers/input/touchscreen/wm9705.c +@@ -9,6 +9,7 @@ + * Russell King + */ + ++#include + #include + #include + #include +--- a/drivers/input/touchscreen/wm9712.c ++++ b/drivers/input/touchscreen/wm9712.c +@@ -9,6 +9,7 @@ + * Russell King + */ + ++#include + #include + #include + #include +--- a/drivers/input/touchscreen/wm9713.c ++++ b/drivers/input/touchscreen/wm9713.c +@@ -9,6 +9,7 @@ + * Russell King + */ + ++#include + #include + #include + #include +--- a/drivers/input/touchscreen/wm97xx-core.c ++++ b/drivers/input/touchscreen/wm97xx-core.c +@@ -29,6 +29,7 @@ + * - Support for async sampling control for noisy LCDs. + */ + ++#include + #include + #include + #include diff --git a/queue-6.12/input-rmi4-refactor-register-descriptor-parsing.patch b/queue-6.12/input-rmi4-refactor-register-descriptor-parsing.patch new file mode 100644 index 0000000000..c64e9b6af9 --- /dev/null +++ b/queue-6.12/input-rmi4-refactor-register-descriptor-parsing.patch @@ -0,0 +1,228 @@ +From sashal@kernel.org Thu Jun 25 18:25:12 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 12:25:08 -0400 +Subject: Input: rmi4 - refactor register descriptor parsing +To: stable@vger.kernel.org +Cc: Dmitry Torokhov , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260625162508.2501015-2-sashal@kernel.org> + +From: Dmitry Torokhov + +[ Upstream commit 0adb483fbf2dc43c875cd7550a58b41e92efc52d ] + +Factor out parsing a register descriptor item from +rmi_read_register_desc() and ensure there are no out-of-bounds accesses. + +Use get_unaligned_le16() and get_unaligned_le32() for reading multi-byte +values. + +Reported-by: Greg Kroah-Hartman +Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices") +Cc: stable@vger.kernel.org +Assisted-by: Gemini:gemini-3.1-pro +Link: https://patch.msgid.link/20260505045952.1570713-2-dmitry.torokhov@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/rmi4/rmi_driver.c | 124 ++++++++++++++++++++++++---------------- + 1 file changed, 76 insertions(+), 48 deletions(-) + +--- a/drivers/input/rmi4/rmi_driver.c ++++ b/drivers/input/rmi4/rmi_driver.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include "rmi_bus.h" + #include "rmi_driver.h" + +@@ -558,30 +559,74 @@ int rmi_scan_pdt(struct rmi_device *rmi_ + return retval < 0 ? retval : 0; + } + ++static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item, ++ const u8 *buf, size_t size) ++{ ++ unsigned int offset = 0; ++ unsigned int map_offset = 0; ++ int b; ++ ++ if (offset >= size) ++ return -EIO; ++ ++ item->reg_size = buf[offset++]; ++ if (item->reg_size == 0) { ++ if (size - offset < 2) ++ return -EIO; ++ item->reg_size = get_unaligned_le16(&buf[offset]); ++ offset += 2; ++ } ++ ++ if (item->reg_size == 0) { ++ if (size - offset < 4) ++ return -EIO; ++ item->reg_size = get_unaligned_le32(&buf[offset]); ++ offset += 4; ++ } ++ ++ do { ++ if (offset >= size) ++ return -EIO; ++ ++ for (b = 0; b < 7; b++) { ++ if (buf[offset] & BIT(b)) { ++ if (map_offset >= RMI_REG_DESC_SUBPACKET_BITS) ++ return -EIO; ++ __set_bit(map_offset, item->subpacket_map); ++ } ++ ++map_offset; ++ } ++ } while (buf[offset++] & BIT(7)); ++ ++ item->num_subpackets = bitmap_weight(item->subpacket_map, ++ RMI_REG_DESC_SUBPACKET_BITS); ++ ++ return offset; ++} ++ + int rmi_read_register_desc(struct rmi_device *d, u16 addr, +- struct rmi_register_descriptor *rdesc) ++ struct rmi_register_descriptor *rdesc) + { + int ret; + u8 size_presence_reg; + u8 buf[35]; +- int presense_offset = 1; +- u8 *struct_buf; +- int reg; +- int offset = 0; +- int map_offset = 0; ++ unsigned int presence_offset; ++ unsigned int map_offset; ++ unsigned int offset; ++ unsigned int reg; + int i; + int b; + + /* + * The first register of the register descriptor is the size of +- * the register descriptor's presense register. ++ * the register descriptor's presence register. + */ + ret = rmi_read(d, addr, &size_presence_reg); + if (ret) + return ret; + ++addr; + +- if (size_presence_reg < 0 || size_presence_reg > 35) ++ if (size_presence_reg < 1 || size_presence_reg > 35) + return -EIO; + + memset(buf, 0, sizeof(buf)); +@@ -597,16 +642,23 @@ int rmi_read_register_desc(struct rmi_de + ++addr; + + if (buf[0] == 0) { +- presense_offset = 3; +- rdesc->struct_size = buf[1] | (buf[2] << 8); ++ if (size_presence_reg < 3) ++ return -EIO; ++ presence_offset = 3; ++ rdesc->struct_size = get_unaligned_le16(&buf[1]); + } else { ++ presence_offset = 1; + rdesc->struct_size = buf[0]; + } + +- for (i = presense_offset; i < size_presence_reg; i++) { ++ map_offset = 0; ++ for (i = presence_offset; i < size_presence_reg; i++) { + for (b = 0; b < 8; b++) { +- if (buf[i] & (0x1 << b)) ++ if (buf[i] & BIT(b)) { ++ if (map_offset >= RMI_REG_DESC_PRESENSE_BITS) ++ return -EIO; + bitmap_set(rdesc->presense_map, map_offset, 1); ++ } + ++map_offset; + } + } +@@ -626,7 +678,7 @@ int rmi_read_register_desc(struct rmi_de + * I'm not using devm_kzalloc here since it will not be retained + * after exiting this function + */ +- struct_buf = kzalloc(rdesc->struct_size, GFP_KERNEL); ++ u8 *struct_buf __free(kfree) = kzalloc(rdesc->struct_size, GFP_KERNEL); + if (!struct_buf) + return -ENOMEM; + +@@ -638,56 +690,32 @@ int rmi_read_register_desc(struct rmi_de + */ + ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size); + if (ret) +- goto free_struct_buff; ++ return ret; + + reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS); ++ offset = 0; + for (i = 0; i < rdesc->num_registers; i++) { + struct rmi_register_desc_item *item = &rdesc->registers[i]; +- int reg_size = struct_buf[offset]; ++ int item_size; + +- ++offset; +- if (reg_size == 0) { +- reg_size = struct_buf[offset] | +- (struct_buf[offset + 1] << 8); +- offset += 2; +- } +- +- if (reg_size == 0) { +- reg_size = struct_buf[offset] | +- (struct_buf[offset + 1] << 8) | +- (struct_buf[offset + 2] << 16) | +- (struct_buf[offset + 3] << 24); +- offset += 4; +- } ++ item_size = rmi_parse_register_desc_item(item, ++ &struct_buf[offset], ++ rdesc->struct_size - offset); ++ if (item_size < 0) ++ return item_size; + + item->reg = reg; +- item->reg_size = reg_size; +- +- map_offset = 0; +- +- do { +- for (b = 0; b < 7; b++) { +- if (struct_buf[offset] & (0x1 << b)) +- bitmap_set(item->subpacket_map, +- map_offset, 1); +- ++map_offset; +- } +- } while (struct_buf[offset++] & 0x80); +- +- item->num_subpackets = bitmap_weight(item->subpacket_map, +- RMI_REG_DESC_SUBPACKET_BITS); ++ offset += item_size; + + rmi_dbg(RMI_DEBUG_CORE, &d->dev, + "%s: reg: %d reg size: %ld subpackets: %d\n", __func__, + item->reg, item->reg_size, item->num_subpackets); + + reg = find_next_bit(rdesc->presense_map, +- RMI_REG_DESC_PRESENSE_BITS, reg + 1); ++ RMI_REG_DESC_PRESENSE_BITS, reg + 1); + } + +-free_struct_buff: +- kfree(struct_buf); +- return ret; ++ return 0; + } + + const struct rmi_register_desc_item *rmi_get_register_desc_item( diff --git a/queue-6.12/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch b/queue-6.12/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch new file mode 100644 index 0000000000..a6820ac99f --- /dev/null +++ b/queue-6.12/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch @@ -0,0 +1,51 @@ +From stable+bounces-268551-greg=kroah.com@vger.kernel.org Thu Jun 25 15:49:56 2026 +From: Sasha Levin +Date: Thu, 25 Jun 2026 09:49:39 -0400 +Subject: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails +To: stable@vger.kernel.org +Cc: Stepan Ionichev , Andy Shevchenko , Greg Kroah-Hartman , Sasha Levin +Message-ID: <20260625134939.2415321-1-sashal@kernel.org> + +From: Stepan Ionichev + +[ Upstream commit 10fc708b4de7f86002d2d735a2dbf3b5b7f65692 ] + +dw8250_probe() registers the 8250 port via serial8250_register_8250_port() +and then, if the device has a clock, registers a clock notifier. If +clk_notifier_register() fails, probe returns the error but leaves the +8250 port registered. The matching serial8250_unregister_port() lives +in dw8250_remove(), which is not called when probe fails, so the port +slot stays occupied until the device is rebound or the system is +rebooted. The devm-allocated driver data is freed while the port still +references it (via the saved private_data and serial_in/serial_out +callbacks), so any access to that port slot before a rebind is a +use-after-free hazard. + +Unregister the port on the clk_notifier_register() error path. + +Fixes: cc816969d7b5 ("serial: 8250_dw: Fix common clocks usage race condition") +Cc: stable@vger.kernel.org +Signed-off-by: Stepan Ionichev +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20260514143746.23671-2-sozdayvek@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_dw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -655,8 +655,10 @@ static int dw8250_probe(struct platform_ + */ + if (data->clk) { + err = clk_notifier_register(data->clk, &data->clk_notifier); +- if (err) ++ if (err) { ++ serial8250_unregister_port(data->data.line); + return dev_err_probe(dev, err, "Failed to set the clock notifier\n"); ++ } + queue_work(system_unbound_wq, &data->clk_work); + } + diff --git a/queue-6.12/series b/queue-6.12/series index 4fc39728ea..583b2458ae 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -190,3 +190,12 @@ nfsd-reset-write-verifier-on-deferred-writeback-errors.patch nfsv4-pnfs-reject-zero-length-r_addr-in-nfs4_decode_mp_ds_addr.patch nfs-prevent-resource-leak-in-nfs_alloc_server.patch ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch +serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch +drivers-base-memory-set-mem-altmap-after-successful-device-registration.patch +documentation-ioctl-number-fix-linuxppc-dev-mailto-link.patch +documentation-ioctl-number-extend-include-file-column-width.patch +crypto-qat-replace-kzalloc-copy_from_user-with-memdup_user.patch +crypto-qat-return-pointer-directly-in-adf_ctl_alloc_resources.patch +crypto-qat-remove-unused-character-device-and-ioctls.patch +input-include-export.h-in-modules-using-export_symbol.patch +input-rmi4-refactor-register-descriptor-parsing.patch