lwn.git/drivers/bus/fsl-mc, branch docs-next

bus: fsl-mc: use generic driver_override infrastructure

2026-04-04T18:41:25+00:00

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Tested-by: Ioana Ciornei Acked-by: Ioana Ciornei Acked-by: Christophe Leroy (CS GROUP) Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Link: https://patch.msgid.link/20260324005919.2408620-3-dakr@kernel.org Signed-off-by: Danilo Krummrich

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

Merge tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-02-17T17:11:04+00:00

Pull char/misc/IIO driver updates from Greg KH: "Here is the big set of char/misc/iio and other smaller driver subsystem changes for 7.0-rc1. Lots of little things in here, including: - Loads of iio driver changes and updates and additions - gpib driver updates - interconnect driver updates - i3c driver updates - hwtracing (coresight and intel) driver updates - deletion of the obsolete mwave driver - binder driver updates (rust and c versions) - mhi driver updates (causing a merge conflict, see below) - mei driver updates - fsi driver updates - eeprom driver updates - lots of other small char and misc driver updates and cleanups All of these have been in linux-next for a while, with no reported issues" * tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (297 commits) mux: mmio: fix regmap leak on probe failure rust_binder: return p from rust_binder_transaction_target_node() drivers: android: binder: Update ARef imports from sync::aref rust_binder: fix needless borrow in context.rs iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin iio: sca3000: Fix a resource leak in sca3000_probe() iio: proximity: rfd77402: Add interrupt handling support iio: proximity: rfd77402: Document device private data structure iio: proximity: rfd77402: Use devm-managed mutex initialization iio: proximity: rfd77402: Use kernel helper for result polling iio: proximity: rfd77402: Align polling timeout with datasheet iio: cros_ec: Allow enabling/disabling calibration mode iio: frequency: ad9523: correct kernel-doc bad line warning iio: buffer: buffer_impl.h: fix kernel-doc warnings iio: gyro: itg3200: Fix unchecked return value in read_raw MAINTAINERS: add entry for ADE9000 driver iio: accel: sca3000: remove unused last_timestamp field iio: accel: adxl372: remove unused int2_bitmask field iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll() iio: magnetometer: Remove IRQF_ONESHOT ...

Merge tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2026-02-11T04:45:30+00:00

Pull SoC driver updates from Arnd Bergmann: "There are are a number of to firmware drivers, in particular the TEE subsystem: - a bus callback for TEE firmware that device drivers can register to - sysfs support for tee firmware information - minor updates to platform specific TEE drivers for AMD, NXP, Qualcomm and the generic optee driver - ARM SCMI firmware refactoring to improve the protocol discover among other fixes and cleanups - ARM FF-A firmware interoperability improvements The reset controller and memory controller subsystems gain support for additional hardware platforms from Mediatek, Renesas, NXP, Canaan and SpacemiT. Most of the other changes are for random drivers/soc code. Among a number of cleanups and newly added hardware support, including: - Mediatek MT8196 DVFS power management and mailbox support - Qualcomm SCM firmware and MDT loader refactoring, as part of the new Glymur platform support. - NXP i.MX9 System Manager firmware support for accessing the syslog - Minor updates for TI, Renesas, Samsung, Apple, Marvell and AMD SoCs" * tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (171 commits) bus: fsl-mc: fix an error handling in fsl_mc_device_add() reset: spacemit: Add SpacemiT K3 reset driver reset: spacemit: Extract common K1 reset code reset: Create subdirectory for SpacemiT drivers dt-bindings: soc: spacemit: Add K3 reset support and IDs reset: canaan: k230: drop OF dependency and enable by default reset: rzg2l-usbphy-ctrl: Add suspend/resume support reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits() reset: gpio: check the return value of gpiod_set_value_cansleep() reset: imx8mp-audiomix: Support i.MX8ULP SIM LPAV reset: imx8mp-audiomix: Extend the driver usage reset: imx8mp-audiomix: Switch to using regmap API reset: imx8mp-audiomix: Drop unneeded macros soc: fsl: qe: qe_ports_ic: Consolidate chained IRQ handler install/remove soc: mediatek: mtk-cmdq: Add mminfra_offset adjustment for DRAM addresses soc: mediatek: mtk-cmdq: Extend cmdq_pkt_write API for SoCs without subsys ID soc: mediatek: mtk-cmdq: Add pa_base parsing for hardware without subsys ID support soc: mediatek: mtk-cmdq: Add cmdq_get_mbox_priv() in cmdq_pkt_create() mailbox: mtk-cmdq: Add driver data to support for MT8196 mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction ...

bus: fsl-mc: Use default primary handler

2026-02-01T16:37:14+00:00

There is no added value in dprc_irq0_handler() compared to irq_default_primary_handler(). Use the default primary interrupt handler by specifying NULL. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Reviewed-by: Ioana Ciornei Link: https://patch.msgid.link/20260128095540.863589-6-bigeasy@linutronix.de

bus: fsl-mc: fix an error handling in fsl_mc_device_add()

2026-01-28T12:35:48+00:00

In fsl_mc_device_add(), device_initialize() is called first. put_device() should be called to drop the reference if error occurs. And other resources would be released via put_device -> fsl_mc_device_release. So remove redundant kfree() in error handling path. Fixes: bbf9d17d9875 ("staging: fsl-mc: Freescale Management Complex (fsl-mc) bus driver") Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/b767348e-d89c-416e-acea-1ebbff3bea20@stanley.mountain/ Signed-off-by: Su Hui Suggested-by: Christophe Leroy (CS GROUP) Signed-off-by: Haoxiang Li Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20260124102054.1613093-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Christophe Leroy (CS GROUP)

bus: fsl-mc: declare fsl_mc_bus_dpdbg_type static

2026-01-16T15:32:48+00:00

Fix following sparse warning: CHECK drivers/bus/fsl-mc/fsl-mc-bus.c drivers/bus/fsl-mc/fsl-mc-bus.c:435:26: warning: symbol 'fsl_mc_bus_dpdbg_type' was not declared. Should it be static? fsl_mc_bus_dpdbg_type is not used outside of fsl-mc-bus.c Remove the EXPORT_SYMBOL and declare it static. Signed-off-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/628c49881b3a1df76cfd2f8fd2aad976692a465a.1768566053.git.chleroy@kernel.org Signed-off-by: Greg Kroah-Hartman

bus: fsl-mc: fix use-after-free in driver_override_show()

2026-01-06T17:56:32+00:00

The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation. Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com Signed-off-by: Christophe Leroy (CS GROUP)

bus: fsl-mc: Convert to bus callbacks

2025-12-14T09:22:19+00:00

With the eventual goal to drop .probe(), .remove() and .shutdown() from struct device_driver, convert the fsl bus to use bus methods. Other than a driver's shutdown callback the bus shutdown callback is also called for unbound drivers. So check for the device being bound before following the pointer to its driver. Signed-off-by: Uwe Kleine-König Reviewed-by: Greg Kroah-Hartman Tested-by: Ioana Ciornei Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/848fffe5c479d899c04a4c99ccb5f0128ccc942d.1764684327.git.u.kleine-koenig@baylibre.com Link: https://lore.kernel.org/r/20251209115950.3382308-2-u.kleine-koenig@baylibre.com [chleroy: squashed the two patches] Signed-off-by: Christophe Leroy (CS GROUP)