Linux kernel documentation tree maintained by Jonathan Corbet http://mirrors.hust.edu.cn/git/lwn.git/atom?h=docs-mw 2026-03-11T14:39:04+00:00 2026-03-11T14:39:04+00:00 Ai Chao aichao@kylinos.cn 2026-03-10T09:44:31+00:00 urn:sha1:224fb8661f66a58530564a2cdce42b219adde4cb Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao <aichao@kylinos.cn> Link: https://patch.msgid.link/20260310094434.3639602-4-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2026-02-22T01:09:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-22T00:37:42+00:00 urn:sha1:bf4afc53b77aeaa48b5409da5c8da6bb4eff7f43 This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 2026-02-21T09:02:28+00:00 Kees Cook kees@kernel.org 2026-02-21T07:49:23+00:00 urn:sha1:69050f8d6d075dc01af7a5f2f550a8067510366f This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> 2025-07-05T05:52:33+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2025-07-05T05:51:39+00:00 urn:sha1:81c3b7256f9ec3c9f7659e4a2aec8d8ead0d4c3b We need the USB fixes in here as well to build on top of for other changes that depend on them. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2025-06-28T15:24:17+00:00 Dan Carpenter dan.carpenter@linaro.org 2025-06-25T15:21:53+00:00 urn:sha1:e35a5d814525006f043b29bffd1bbdcb549b23c5 There is no need to check if "port" is NULL. We already verified that it is non-NULL. It's a stack variable and can't be modified by a different thread. Delete this dead code. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Prashanth K <prashanth.k@oss.qualcomm.com> Link: https://lore.kernel.org/r/685c1413.050a0220.1a8223.d0b9@mx.google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2025-06-19T10:41:13+00:00 Kuen-Han Tsai khtsai@google.com 2025-06-17T05:07:12+00:00 urn:sha1:c529c3730bd09115684644e26bf01ecbd7e2c2c9 A race condition occurs when gs_start_io() calls either gs_start_rx() or gs_start_tx(), as those functions briefly drop the port_lock for usb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear port.tty and port_usb, respectively. Use the null-safe TTY Port helper function to wake up TTY. Example CPU1: CPU2: gserial_connect() // lock gs_close() // await lock gs_start_rx() // unlock usb_ep_queue() gs_close() // lock, reset port.tty and unlock gs_start_rx() // lock tty_wakeup() // NPE Fixes: 35f95fd7f234 ("TTY: usb/u_serial, use tty from tty_port") Cc: stable <stable@kernel.org> Signed-off-by: Kuen-Han Tsai <khtsai@google.com> Reviewed-by: Prashanth K <prashanth.k@oss.qualcomm.com> Link: https://lore.kernel.org/linux-usb/20240116141801.396398-1-khtsai@google.com/ Link: https://lore.kernel.org/r/20250617050844.1848232-2-khtsai@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2025-06-19T10:41:09+00:00 Kuen-Han Tsai khtsai@google.com 2025-06-17T05:07:11+00:00 urn:sha1:f6c7bc4a6823a0a959f40866a1efe99bd03c2c5b This reverts commit ffd603f214237e250271162a5b325c6199a65382. Commit ffd603f21423 ("usb: gadget: u_serial: Add null pointer check in gs_start_io") adds null pointer checks at the beginning of the gs_start_io() function to prevent a null pointer dereference. However, these checks are redundant because the function's comment already requires callers to hold the port_lock and ensure port.tty and port_usb are not null. All existing callers already follow these rules. The true cause of the null pointer dereference is a race condition. When gs_start_io() calls either gs_start_rx() or gs_start_tx(), the port_lock is temporarily released for usb_ep_queue(). This allows port.tty and port_usb to be cleared. Fixes: ffd603f21423 ("usb: gadget: u_serial: Add null pointer check in gs_start_io") Cc: stable <stable@kernel.org> Signed-off-by: Kuen-Han Tsai <khtsai@google.com> Reviewed-by: Prashanth K <prashanth.k@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250617050844.1848232-1-khtsai@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2025-05-21T11:10:07+00:00 Prashanth K prashanth.k@oss.qualcomm.com 2025-05-06T10:49:12+00:00 urn:sha1:1c06aff9b82fc3795a80feeb23935b9a44b07e71 Avoid unlocking serial_port_lock twice in gserial_suspend(), this can occur if gserial_wakeup_host() fails. And since wakeup is performed outside spinlock, check if the port is valid before proceeding again. Fixes: 3baea29dc0a7 ("usb: gadget: u_serial: Implement remote wakeup capability") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/all/aBHatifO5bjR1yPt@stanley.mountain/ Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250506104912.3750934-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2025-04-25T11:42:04+00:00 Prashanth K prashanth.k@oss.qualcomm.com 2025-04-24T12:11:42+00:00 urn:sha1:3baea29dc0a7b561170d7082f831a613ae6aa56e Implement the remote wakeup capability for u_serial. The newly added function gserial_wakeup_host() wakes up the host when there is some data to be sent while the device is suspended. Add gser_get_status() callbacks to advertise f_serial interface as function wakeup capable. Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250424121142.4180241-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2025-01-17T11:41:16+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2025-01-17T08:17:12+00:00 urn:sha1:086fd062bc3883ae1ce4166cff5355db315ad879 This reverts commit 13014969cbf07f18d62ceea40bd8ca8ec9d36cec. It is reported to cause crashes on Tegra systems, so revert it for now. Link: https://lore.kernel.org/r/1037c1ad-9230-4181-b9c3-167dbaa47644@nvidia.com Reported-by: Jon Hunter <jonathanh@nvidia.com> Cc: stable <stable@kernel.org> Cc: Lianqin Hu <hulianqin@vivo.com> Link: https://lore.kernel.org/r/2025011711-yippee-fever-a737@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>