summaryrefslogtreecommitdiffstats
path: root/drivers/staging
AgeCommit message (Collapse)AuthorLines
8 daysMerge tag 'staging-7.1-rc1' of ↵HEADmasterLinus Torvalds-2251/+1719
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the "big" set of staging driver changes for 7.1-rc1. Nothing major in here at all, just lots of little cleanups for the staging drivers, driven by new developers getting their feet wet in kernel development. "Largest" thing in here is the change of some of the octeon variable types into proper kernel ones. Full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'staging-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (154 commits) staging: rtl8723bs: remove redundant & parentheses staging: most: dim2: replace BUG_ON() in poison_channel() staging: most: dim2: replace BUG_ON() in enqueue() staging: most: dim2: replace BUG_ON() in configure_channel() staging: most: dim2: replace BUG_ON() in service_done_flag() staging: most: dim2: replace BUG_ON() in try_start_dim_transfer() staging: rtl8723bs: remove unused RTL8188E antenna selection macros staging: rtl8723bs: remove redundant blank lines in basic_types.h staging: rtl8723bs: wrap complex macros with parentheses staging: rtl8723bs: remove unused WRITEEF/READEF byte macros staging: rtl8723bs: rename camelCase variable staging: greybus: audio: fix error message for BTN_3 button staging: rtl8723bs: rename variables to snake_case staging: rtl8723bs: fix spelling in comment staging: rtl8723bs: cleanup return in sdio_init() staging: rtl8723bs: use direct returns in sdio_dvobj_init() staging: rtl8723bs: remove unused arg at odm_interface.h greybus: raw: fix use-after-free if write is called after disconnect greybus: raw: fix use-after-free on cdev close staging: rtl8723bs: fix logical continuations in xmit_linux.c ...
12 daysMerge tag 'mm-stable-2026-04-13-21-45' of ↵Linus Torvalds-32/+41
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "maple_tree: Replace big node with maple copy" (Liam Howlett) Mainly prepararatory work for ongoing development but it does reduce stack usage and is an improvement. - "mm, swap: swap table phase III: remove swap_map" (Kairui Song) Offers memory savings by removing the static swap_map. It also yields some CPU savings and implements several cleanups. - "mm: memfd_luo: preserve file seals" (Pratyush Yadav) File seal preservation to LUO's memfd code - "mm: zswap: add per-memcg stat for incompressible pages" (Jiayuan Chen) Additional userspace stats reportng to zswap - "arch, mm: consolidate empty_zero_page" (Mike Rapoport) Some cleanups for our handling of ZERO_PAGE() and zero_pfn - "mm/kmemleak: Improve scan_should_stop() implementation" (Zhongqiu Han) A robustness improvement and some cleanups in the kmemleak code - "Improve khugepaged scan logic" (Vernon Yang) Improve khugepaged scan logic and reduce CPU consumption by prioritizing scanning tasks that access memory frequently - "Make KHO Stateless" (Jason Miu) Simplify Kexec Handover by transitioning KHO from an xarray-based metadata tracking system with serialization to a radix tree data structure that can be passed directly to the next kernel - "mm: vmscan: add PID and cgroup ID to vmscan tracepoints" (Thomas Ballasi and Steven Rostedt) Enhance vmscan's tracepointing - "mm: arch/shstk: Common shadow stack mapping helper and VM_NOHUGEPAGE" (Catalin Marinas) Cleanup for the shadow stack code: remove per-arch code in favour of a generic implementation - "Fix KASAN support for KHO restored vmalloc regions" (Pasha Tatashin) Fix a WARN() which can be emitted the KHO restores a vmalloc area - "mm: Remove stray references to pagevec" (Tal Zussman) Several cleanups, mainly udpating references to "struct pagevec", which became folio_batch three years ago - "mm: Eliminate fake head pages from vmemmap optimization" (Kiryl Shutsemau) Simplify the HugeTLB vmemmap optimization (HVO) by changing how tail pages encode their relationship to the head page - "mm/damon/core: improve DAMOS quota efficiency for core layer filters" (SeongJae Park) Improve two problematic behaviors of DAMOS that makes it less efficient when core layer filters are used - "mm/damon: strictly respect min_nr_regions" (SeongJae Park) Improve DAMON usability by extending the treatment of the min_nr_regions user-settable parameter - "mm/page_alloc: pcp locking cleanup" (Vlastimil Babka) The proper fix for a previously hotfixed SMP=n issue. Code simplifications and cleanups ensued - "mm: cleanups around unmapping / zapping" (David Hildenbrand) A bunch of cleanups around unmapping and zapping. Mostly simplifications, code movements, documentation and renaming of zapping functions - "support batched checking of the young flag for MGLRU" (Baolin Wang) Batched checking of the young flag for MGLRU. It's part cleanups; one benchmark shows large performance benefits for arm64 - "memcg: obj stock and slab stat caching cleanups" (Johannes Weiner) memcg cleanup and robustness improvements - "Allow order zero pages in page reporting" (Yuvraj Sakshith) Enhance free page reporting - it is presently and undesirably order-0 pages when reporting free memory. - "mm: vma flag tweaks" (Lorenzo Stoakes) Cleanup work following from the recent conversion of the VMA flags to a bitmap - "mm/damon: add optional debugging-purpose sanity checks" (SeongJae Park) Add some more developer-facing debug checks into DAMON core - "mm/damon: test and document power-of-2 min_region_sz requirement" (SeongJae Park) An additional DAMON kunit test and makes some adjustments to the addr_unit parameter handling - "mm/damon/core: make passed_sample_intervals comparisons overflow-safe" (SeongJae Park) Fix a hard-to-hit time overflow issue in DAMON core - "mm/damon: improve/fixup/update ratio calculation, test and documentation" (SeongJae Park) A batch of misc/minor improvements and fixups for DAMON - "mm: move vma_(kernel|mmu)_pagesize() out of hugetlb.c" (David Hildenbrand) Fix a possible issue with dax-device when CONFIG_HUGETLB=n. Some code movement was required. - "zram: recompression cleanups and tweaks" (Sergey Senozhatsky) A somewhat random mix of fixups, recompression cleanups and improvements in the zram code - "mm/damon: support multiple goal-based quota tuning algorithms" (SeongJae Park) Extend DAMOS quotas goal auto-tuning to support multiple tuning algorithms that users can select - "mm: thp: reduce unnecessary start_stop_khugepaged()" (Breno Leitao) Fix the khugpaged sysfs handling so we no longer spam the logs with reams of junk when starting/stopping khugepaged - "mm: improve map count checks" (Lorenzo Stoakes) Provide some cleanups and slight fixes in the mremap, mmap and vma code - "mm/damon: support addr_unit on default monitoring targets for modules" (SeongJae Park) Extend the use of DAMON core's addr_unit tunable - "mm: khugepaged cleanups and mTHP prerequisites" (Nico Pache) Cleanups to khugepaged and is a base for Nico's planned khugepaged mTHP support - "mm: memory hot(un)plug and SPARSEMEM cleanups" (David Hildenbrand) Code movement and cleanups in the memhotplug and sparsemem code - "mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE and cleanup CONFIG_MIGRATION" (David Hildenbrand) Rationalize some memhotplug Kconfig support - "change young flag check functions to return bool" (Baolin Wang) Cleanups to change all young flag check functions to return bool - "mm/damon/sysfs: fix memory leak and NULL dereference issues" (Josh Law and SeongJae Park) Fix a few potential DAMON bugs - "mm/vma: convert vm_flags_t to vma_flags_t in vma code" (Lorenzo Stoakes) Convert a lot of the existing use of the legacy vm_flags_t data type to the new vma_flags_t type which replaces it. Mainly in the vma code. - "mm: expand mmap_prepare functionality and usage" (Lorenzo Stoakes) Expand the mmap_prepare functionality, which is intended to replace the deprecated f_op->mmap hook which has been the source of bugs and security issues for some time. Cleanups, documentation, extension of mmap_prepare into filesystem drivers - "mm/huge_memory: refactor zap_huge_pmd()" (Lorenzo Stoakes) Simplify and clean up zap_huge_pmd(). Additional cleanups around vm_normal_folio_pmd() and the softleaf functionality are performed. * tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (369 commits) mm: fix deferred split queue races during migration mm/khugepaged: fix issue with tracking lock mm/huge_memory: add and use has_deposited_pgtable() mm/huge_memory: add and use normal_or_softleaf_folio_pmd() mm: add softleaf_is_valid_pmd_entry(), pmd_to_softleaf_folio() mm/huge_memory: separate out the folio part of zap_huge_pmd() mm/huge_memory: use mm instead of tlb->mm mm/huge_memory: remove unnecessary sanity checks mm/huge_memory: deduplicate zap deposited table call mm/huge_memory: remove unnecessary VM_BUG_ON_PAGE() mm/huge_memory: add a common exit path to zap_huge_pmd() mm/huge_memory: handle buggy PMD entry in zap_huge_pmd() mm/huge_memory: have zap_huge_pmd return a boolean, add kdoc mm/huge: avoid big else branch in zap_huge_pmd() mm/huge_memory: simplify vma_is_specal_huge() mm: on remap assert that input range within the proposed VMA mm: add mmap_action_map_kernel_pages[_full]() uio: replace deprecated mmap hook with mmap_prepare in uio_info drivers: hv: vmbus: replace deprecated mmap hook with mmap_prepare mm: allow handling of stacked mmap_prepare hooks in more drivers ...
12 daysMerge tag 'media/v7.1-1' of ↵Linus Torvalds-3446/+881
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - new CSI tegra support, covering Tegra20 and Tegra30 - new camera sensor drivers: T4ka3 and ov2732 - m88ds3103: add 3103c chip support - uvcvideo: add support for Intel RealSense D436/D555 and P010 pixel format - synopsys csi2rx: add i.MX93 support - imx8-isi: add i.MX95 support - imx8mq-mipi-csi2: add i.MX8ULP support - dw100: add V4L2 requests support - support for DTV devices from Hauppauge got some improvements - media staging: dropped starfive-camss driver - media docs: document multi-committers model and improve maint profile - media core: - add v4l2_subdev_get_frame_desc_passthrough() helper - improve error handling in fwnode parsing - lots of driver fixes, cleanups and improvements * tag 'media/v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (251 commits) Revert "media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935" media: synopsys: csi2rx: add i.MX93 support media: dt-bindings: add NXP i.MX93 compatible string media: synopsys: csi2rx: Use enum and u32 array for register offsets media: synopsys: csi2rx: implement .get_frame_desc() callback media: synopsys: csi2rx: only check errors from devm_clk_bulk_get_all() media: synopsys: csi2rx: use devm_reset_control_get_optional_exclusive() media: i2c: imx283: add support for non-continuous MIPI clock mode media: i2c: ov08d10: add support for 24 MHz input clock media: i2c: ov08d10: add support for reset and power management media: i2c: ov08d10: add support for binding via device tree dt-bindings: media: i2c: document Omnivision OV08D10 CMOS image sensor media: i2c: ov08d10: add missing newline to prints media: i2c: ov08d10: fix some typos in comments media: i2c: ov08d10: remove duplicate register write media: i2c: ov08d10: fix image vertical start setting media: i2c: ov08d10: fix runtime PM handling in probe staging: media: ipu7: Update TODO media: Add t4ka3 camera sensor driver media: i2c: Add ov2732 image sensor driver ...
2026-04-05staging: vme_user: replace deprecated mmap hook with mmap_prepareLorenzo Stoakes (Oracle)-32/+41
The f_op->mmap interface is deprecated, so update driver to use its successor, mmap_prepare. The driver previously used vm_iomap_memory(), so this change replaces it with its mmap_prepare equivalent, mmap_action_simple_ioremap(). Functions that wrap mmap() are also converted to wrap mmap_prepare() instead. Also update the documentation accordingly. Link: https://lkml.kernel.org/r/08ecc1e1d319564fd49b9e9012f994edaff921db.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org> Reviewed-by: Suren Baghdasaryan <surenb@google.com> Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Alexandre Torgue <alexandre.torgue@foss.st.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Bodo Stroesser <bostroesser@gmail.com> Cc: Christian Brauner <brauner@kernel.org> Cc: Clemens Ladisch <clemens@ladisch.de> Cc: David Hildenbrand <david@kernel.org> Cc: David Howells <dhowells@redhat.com> Cc: Dexuan Cui <decui@microsoft.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Haiyang Zhang <haiyangz@microsoft.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: K. Y. Srinivasan <kys@microsoft.com> Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Long Li <longli@microsoft.com> Cc: Marc Dionne <marc.dionne@auristor.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Miquel Raynal <miquel.raynal@bootlin.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Richard Weinberger <richard@nod.at> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Vignesh Raghavendra <vigneshr@ti.com> Cc: Wei Liu <wei.liu@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-04-04staging: rtl8723bs: remove redundant & parenthesesSam Daly-2/+2
Remove redundant parentheses around the '&' operator to comply with kernel style guidelines, as reported by checkpatch: CHECK: Unnecessary parentheses around adapter->securitypriv Signed-off-by: Sam Daly <sam@samdaly.ie> Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com> Link: https://patch.msgid.link/20260403172839.367663-1-sam@samdaly.ie Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: most: dim2: replace BUG_ON() in poison_channel()Gabriel Rondon-1/+2
Replace BUG_ON() range check on ch_idx with a return of -EINVAL. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260330182255.75241-6-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: most: dim2: replace BUG_ON() in enqueue()Gabriel Rondon-1/+2
Replace BUG_ON() range check on ch_idx with a return of -EINVAL. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260330182255.75241-5-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: most: dim2: replace BUG_ON() in configure_channel()Gabriel Rondon-1/+2
Replace BUG_ON() range check on ch_idx with a return of -EINVAL. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260330182255.75241-4-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: most: dim2: replace BUG_ON() in service_done_flag()Gabriel Rondon-2/+2
Replace BUG_ON() calls with an early return since the function returns void. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260330182255.75241-3-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: most: dim2: replace BUG_ON() in try_start_dim_transfer()Gabriel Rondon-3/+6
Replace BUG_ON() calls with graceful error handling. For the null/uninitialized channel checks, return -EINVAL instead of crashing the kernel. For the zero bus_address check, release the spinlock and return -EFAULT. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260330182255.75241-2-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove unused RTL8188E antenna selection macrosMashiro Chen-4/+0
Remove the SET_TX_DESC_ANTSEL_{A,B,C}_88E macros from odm_types.h. These are leftover dead code for the RTL8188E chip and have no callers in the rtl8723bs driver. The RTL8188E is a different chip family and has its own driver at drivers/net/wireless/realtek/rtl8xxxu This addresses the TODO item "find and remove any code for other chips that is left over". Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org> Link: https://patch.msgid.link/20260331050434.102744-1-mashiro.chen@mailbox.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove redundant blank lines in basic_types.hMashiro Chen-1/+0
Remove redundant blank lines at the top of the file to improve code cleanliness. Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260330114232.91431-4-mashiro.chen@mailbox.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: wrap complex macros with parenthesesMashiro Chen-6/+6
Fix "COMPLEX_MACRO" errors reported by checkpatch.pl by wrapping macro values in parentheses to ensure correct operator precedence. Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260330114232.91431-3-mashiro.chen@mailbox.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove unused WRITEEF/READEF byte macrosMashiro Chen-25/+0
The WRITEEF4BYTE, WRITEEF2BYTE, WRITEEF1BYTE, READEF4BYTE, READEF2BYTE and READEF1BYTE macros are never used in the driver. Remove them entirely. Suggested-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260330114232.91431-2-mashiro.chen@mailbox.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: rename camelCase variableBhavya Gupta-6/+6
Rename the "pIE" variable to "ie" to comply with the linux kernel coding style. This fixes the following checkpatch.pl warnings: CHECK: Avoid CamelCase: <pIE> Signed-off-by: Bhavya Gupta <anim8tor.ing@gmail.com> Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com> Link: https://patch.msgid.link/ab6aELnTA0EnQI6X@gamin8ing Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: greybus: audio: fix error message for BTN_3 buttonHaoyu Lu-1/+1
In gbaudio_init_jack(), when setting SND_JACK_BTN_3 key, the error message incorrectly says "Failed to set BTN_0". This should be "Failed to set BTN_3" to match the button being configured. Signed-off-by: Haoyu Lu <hechushiguitu666@gmail.com> Reviewed-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260330083425.266-1-hechushiguitu666@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: rename variables to snake_caseDavid Holland-19/+19
The Linux kernel coding style guidelines prohibit the use of CamelCase variable names. All variables should be snakecase. Rename the 'ChipVersion' parameter to 'chip_version' and the 'AutoLoadFail' parameter to 'auto_load_fail' in hal_com.c to adhere to the standard snakecase naming convention. Signed-off-by: David Holland <david@cardinalsystem.net> Link: https://patch.msgid.link/20260327203636.24891-1-david@cardinalsystem.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: fix spelling in commentHaoyu Lu-1/+1
Change "co-existance" to "co-existence" in comment. Signed-off-by: Haoyu Lu <hechushiguitu666@gmail.com> Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com> Link: https://patch.msgid.link/20260327111455.3260-1-hechushiguitu666@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: cleanup return in sdio_init()Omer El Idrissi-8/+8
Make sdio_init() return errno from sdio_enable_func or sdio_set_block_size instead of _SUCCESS/_FAIL vendor-defined macros. Let rtw_resume_process_normal return errno returned by sdio_init instead of -1. sdio_dvobj_init returns NULL on error so leave that as is. Let sdio_dvobj_init use a slightly more readable and conventional error check for sdio_init(). Signed-off-by: Omer El Idrissi <omer.e.idrissi@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260326093607.13011-3-omer.e.idrissi@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: use direct returns in sdio_dvobj_init()Omer El Idrissi-11/+6
Make sdio_dvobj_init() use direct returns Signed-off-by: Omer El Idrissi <omer.e.idrissi@gmail.com> Signed-off-by: Omer El Idrissi <omer.e.idriss@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260326093607.13011-2-omer.e.idrissi@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove unused arg at odm_interface.hRodrigo Gobbi-16/+16
The header file uses some macros to create proper constants for ODM_REG and ODM_SET but current macros were not using _ic_type, leading to a checkpatch warn: WARNING: Argument '_ic_type' is not used in function-like macro Remove that arg, currently there is no support for per ic type Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com> Link: https://patch.msgid.link/20260325212826.20309-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31greybus: raw: fix use-after-free if write is called after disconnectDamien Riégel-2/+21
If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y): BUG: kernel NULL pointer dereference, address: 0000000000000218 ... Call Trace: <TASK> gb_operation_create_common+0x61/0x180 gb_operation_create_flags+0x28/0xa0 gb_operation_sync_timeout+0x6f/0x100 raw_write+0x7b/0xc7 [gb_raw] vfs_write+0xcf/0x420 ? task_mm_cid_work+0x136/0x220 ksys_write+0x63/0xe0 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f Disconnect calls gb_connection_destroy, which ends up freeing the connection object. When gb_operation_sync is called in the write file operations, its gets a freed connection as parameter and the kernel panics. The gb_connection_destroy cannot be moved out of the disconnect function, as the Greybus subsystem expect all connections belonging to a bundle to be destroyed when disconnect returns. To prevent this bug, use a rw lock to synchronize access between write and disconnect. This guarantees that the write function doesn't try to use a disconnected connection. Fixes: e806c7fb8e9b ("greybus: raw: add raw greybus kernel driver") Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Damien Riégel <damien.riegel@silabs.com> Link: https://patch.msgid.link/20260324140039.40001-2-damien.riegel@silabs.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31greybus: raw: fix use-after-free on cdev closeDamien Riégel-35/+34
This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y): refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130 ... Call Trace: <TASK> cdev_put+0x18/0x30 __fput+0x255/0x2a0 __x64_sys_close+0x3d/0x80 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f The cdev is contained in the "gb_raw" structure, which is freed in the disconnect operation. When the cdev is released at a later time, cdev_put gets an address that points to freed memory. To fix this use-after-free, convert the struct device from a pointer to being embedded, that makes the lifetime of the cdev and of this device the same. Then, use cdev_device_add, which guarantees that the device won't be released until all references to the cdev have been released. Finally, delegate the freeing of the structure to the device release function, instead of freeing immediately in the disconnect callback. Fixes: e806c7fb8e9b ("greybus: raw: add raw greybus kernel driver") Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: Damien Riégel <damien.riegel@silabs.com> Link: https://patch.msgid.link/20260324140039.40001-1-damien.riegel@silabs.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: fix logical continuations in xmit_linux.cSajal Gupta-6/+3
Simplify the conditional by removing redundant boolean comparisons and fixing the continuation line indentation. Signed-off-by: Sajal Gupta <sajal2005gupta@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Link: https://patch.msgid.link/20260324121828.14675-1-sajal2005gupta@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: sm750fb: fix division by zero in ps_to_hz()Junrui Luo-0/+3
ps_to_hz() is called from hw_sm750_crtc_set_mode() without validating that pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO causes a division by zero. Fix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent with other framebuffer drivers. Fixes: 81dee67e215b ("staging: sm750fb: add sm750 to staging") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Link: https://patch.msgid.link/SYBPR01MB7881AFBFCE28CCF528B35D0CAF4BA@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove custom is_multicast_mac_addr() functionNikolay Kulikov-7/+2
is_multicast_mac_addr() is redundant reimplementation of standard is_multicast_ether_addr() func. Remove it and switch to use is_multicast_ether_addr(). Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260323150650.7168-7-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove custom is_broadcast_mac_addr() functionNikolay Kulikov-10/+4
Replace the custom broadcast address checking function with standard kernel is_broadcast_ether_addr() func for this. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260323150650.7168-6-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove custom is_zero_mac_addr() functionNikolay Kulikov-8/+2
Remove the custom function is_zero_mac_addr() and replace all calls to it with the default kernel function is_zero_ether_addr() to avoid duplicating existing code. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260323150650.7168-5-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: move logical operators to end of previous lineNikolay Kulikov-5/+3
Change the position of logical operators '||' and remove unnecessary curly braces around single expression to fix checkpatch.pl warnings. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260323150650.7168-4-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove dead code in validate_recv_mgnt_frame()Nikolay Kulikov-1/+0
Remove unused code from the validate_recv_mgnt_frame() function. This code was previously commented out and is no longer needed. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260323150650.7168-3-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: replace deeply nested if-else with switch-caseNikolay Kulikov-20/+28
The main logic of the validate_recv_mgnt_frame() function is deeply nested due to multiple if-else statements and additional block scope. Fix this by replacing identical if-else with switch-case statements, which will improve code readability and correct checkpatch.pl warnings about line lengths. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260323150650.7168-2-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()Lin YuChen-1/+1
Initialize le_tmp64 to zero in rtw_BIP_verify() to prevent using uninitialized data. Smatch warns that only 6 bytes are copied to this 8-byte (u64) variable, leaving the last two bytes uninitialized: drivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify() warn: not copying enough bytes for '&le_tmp64' (8 vs 6 bytes) Initializing the variable at the start of the function fixes this warning and ensures predictable behavior. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable <stable@kernel.org> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/linux-staging/abvwIQh0CHTp4wNJ@stanley.mountain/ Signed-off-by: Lin YuChen <starpt.official@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260320172502.167332-1-starpt.official@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove unused function declarationsOskar Ray-Frayssinet-2/+0
Remove unused declarations of MRateToHwRate8723B() and HwRateToMRate8723B() from rtl8723b_hal.h as they have no implementation and are never called. Signed-off-by: Oskar Ray-Frayssinet <rayfraytech@gmail.com> Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com> Link: https://patch.msgid.link/20260321223347.7054-1-rayfraytech@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: refactor rtw_joinbss_event_prehandle to reduce indentationJose A. Perez de Azpillaga-65/+70
The rtw_joinbss_event_prehandle function has excessive indentation due to deeply nested if-statements. Refactor the function using early returns and guard clauses for the failure paths. This flattens the code and significantly improves readability. Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260321182713.665872-3-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: remove dead REJOIN codeJose A. Perez de Azpillaga-26/+2
The REJOIN macro is not defined anywhere in the kernel tree. Remove this dead code to simplify the function. Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260321182713.665872-2-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: use guard clause for stainfo checkLin YuChen-49/+47
Continue the refactor of rtw_aes_decrypt() by introducing a guard clause for the stainfo check. This allows the subsequent multicast and unicast decryption logic to be moved one indentation level to the left, further improving code readability. Signed-off-by: Lin YuChen <starpt.official@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260319120737.29692-3-starpt.official@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: use guard clause for AES checkLin YuChen-52/+52
Refactor the AES encryption check by using a guard clause to reduce the indentation level of the subsequent logic. Signed-off-by: Lin YuChen <starpt.official@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20260319120737.29692-2-starpt.official@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: split multiple assignment in rtw_mgmt_xmitframe_coalesceMarco Antonio Solis Segura-2/+3
Cleanup the multiple assignment of tmp_buf and BIP_AAD to fix the checkpatch.pl CHECK: "Multiple assignments should be avoided". Additionally, reorder the assignments to ensure tmp_buf is assigned only after BIP_AAD has been validated as non-NULL. Signed-off-by: Marco Antonio Solis Segura <mshdevv@gmail.com> Link: https://patch.msgid.link/20260319062626.605200-1-mshdevv@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-31staging: rtl8723bs: Remove dead codeBera Yüzlü-34/+0
Clean up the dm_odm_t structure by removing commented-out members and related legacy comments. Signed-off-by: Bera Yüzlü <b9788213@gmail.com> Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com> Link: https://patch.msgid.link/20260318195005.23962-1-b9788213@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-26staging: media: ipu7: Update TODOSakari Ailus-7/+5
Remove cleanup of the register definitions from the TODO file. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: staging: imx: configure src_mux in csi_startMichael Tretter-20/+24
After media_pipeline_start() was called, the media graph is assumed to be validated. It won't be validated again if a second stream starts. The imx-media-csi driver, however, changes hardware configuration in the link_validate() callback. This can result in started streams with misconfigured hardware. In the concrete example, the ipu2_csi1 is driven by a parallel video input. After the media pipeline has been started with this configuration, a second stream is configured to use ipu1_csi0 with MIPI-CSI input from imx6-mipi-csi2. This may require the reconfiguration of ipu1_csi0 with ipu_set_csi_src_mux(). Since the media pipeline is already running, link_validate won't be called, and the ipu1_csi0 won't be reconfigured. The resulting video is broken, because the ipu1_csi0 is misconfigured, but no error is reported. Move ipu_set_csi_src_mux from csi_link_validate to csi_start to ensure that input to ipu1_csi0 is configured correctly when starting the stream. This is a local reconfiguration in ipu1_csi0 and is possible while the media pipeline is running. Since csi_start() is called with priv->lock already locked, csi_set_src() must not lock priv->lock again. Thus, the mutex_lock() is dropped. Signed-off-by: Michael Tretter <m.tretter@pengutronix.de> Fixes: 4a34ec8e470c ("[media] media: imx: Add CSI subdev driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: staging: imx: request mbus_config in csi_startMichael Tretter-16/+24
Request the upstream mbus_config in csi_start, which starts the stream, instead of caching it in link_validate. This allows to get rid of the mbus_cfg field in the struct csi_priv and avoids state in the driver. Fixes: 4a34ec8e470c ("[media] media: imx: Add CSI subdev driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Michael Tretter <m.tretter@pengutronix.de> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: staging: imx: fix code style issuesvivek yadav-3/+3
Applied checkpatch.pl recommendations: - corrected whitespace - fixed line length - adjusted indentation Signed-off-by: vivek yadav <y9.vivek@gmail.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: staging: imx: Remove unnecessary braces from if statementAyush Kumar-2/+1
Adhering to Linux kernel coding style guidelines (Chapter 3: Indentation). Signed-off-by: Ayush Kumar <ayushkr0s@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-19Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski-17/+26
Cross-merge networking fixes after downstream PR (net-7.0-rc5). net/netfilter/nft_set_rbtree.c 598adea720b97 ("netfilter: revert nft_set_rbtree: validate open interval overlap") 3aea466a43998 ("netfilter: nft_set_rbtree: don't disable bh when acquiring tree lock") https://lore.kernel.org/abgaQBpeGstdN4oq@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19staging: media: tegra-video: add CSI support for Tegra20 and Tegra30Svyatoslav Ryhel-47/+608
Add support for MIPI CSI device and calibration logic found in Tegra20 and Tegra30 SoC. To get CSI operational, an additional syncpoint was allocated to serve as the CSI frame counter. Both VIP and CSI use an existing syncpoint for VI frame start events. That said, the frame capture function was refactored to reflect the addition of the CSI syncpoint, and the CSI-specific configuration is guarded by the presence of a passed CSI channel structure pointer. The camera capture setup's configuration was reconsidered: the first two writes must be done before tegra_channel_set_stream for MIPI calibration to work properly; the third write was moved to VIP/CSI-specific functions since it must be source-specific; the function was placed after tegra_channel_set_stream so the initial sequence is preserved and expanded. CSI configuration sequences were added based on downstream 3.1 kernel sources and adjusted to the existing video-tegra framework. Although Tegra20 and Tegra30 have the same set of configurations, they differ by the number of clocks used by CSI. Dropped the software syncpoint counters in favor of reading syncpoints directly and passing the incremented value to the polling function. If the syncpoint increase fails, the PP is reset. This change should prevent possible race conditions. MIPI calibration logic was registered in CSI since Tegra20 and Tegra30 have no dedicated hardware block for these operations and use CSI. These calls are used for both CSI and DSI to work properly, which is why MIPI calibration cannot be contained within CSI. The pads passed to the calibration calls resemble CSI PORT_A (0), CSI PORT_B (1), DSI-A (3) and DSI-B (4). Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera Co-developed-by: Jonas Schwöbel <jonasschwoebel@yahoo.de> Signed-off-by: Jonas Schwöbel <jonasschwoebel@yahoo.de> Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-19staging: media: tegra-video: tegra20: adjust luma buffer strideSvyatoslav Ryhel-1/+1
Luma buffer stride is calculated by multiplying height in pixels of image by bytes per line. Adjust that value accordingly. Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-19staging: media: tegra-video: tegra20: expand format support with RAW8/10 and ↵Svyatoslav Ryhel-3/+71
YUV422/YUV420p 1X16 Add support for Bayer formats (RAW8 and RAW10) and YUV422/420p 1X16 versions of existing YUV422/YUV420p 2X8. Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-19staging: media: tegra-video: tegra20: increase maximum VI clock frequencySvyatoslav Ryhel-1/+1
Increase maximum VI clock frequency to 450MHz to allow correct work with high resolution camera sensors. Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-19staging: media: tegra-video: tegra20: set VI HW revisionSvyatoslav Ryhel-0/+1
According to TRM Tegra20, Tegra30 and Tegra114 have VI revision 1, Tegra124 has revision 2 and Tegra210 has revision 3. Set correct revision in tegra20_vi_soc like tegra210 does. Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>