kernel/git/stable/linux.git/arch/powerpc/sysdev, branch linux-7.2.y

powerpc/xive: propagate IPI init errors to prevent use-after-free

2026-09-14T11:40:12+00:00

[ Upstream commit 411a3c016e7a95f5fa105a0587e07d0647a77727 ] When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free. Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free. Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller") Fixes: cbc06f051c52 ("powerpc/xive: Do not skip CPU-less nodes when creating the IPIs") Signed-off-by: Gou Hao Reviewed-by: Wentao Guan Reviewed-by: jiazhenyuan Reviewed-by: Cédric Le Goater Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727104215.184786-4-gouhao@uniontech.com Signed-off-by: Sasha Levin

powerpc/xive: add error return value to xive_smp_probe()

2026-09-14T11:40:12+00:00

[ Upstream commit ab5ae5dceb86614f6c9e7488f91b652000edfdc5 ] xive_smp_probe() calls xive_init_ipis() which can fail, but its return value is currently ignored. Change xive_smp_probe() to return int so that errors can be propagated to callers. This is a preparatory patch for the next one. No functional change yet; the return value is always 0 at this point. Signed-off-by: Gou Hao Reviewed-by: Wentao Guan Reviewed-by: jiazhenyuan Reviewed-by: Cédric Le Goater Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727104215.184786-3-gouhao@uniontech.com Stable-dep-of: 411a3c016e7a ("powerpc/xive: propagate IPI init errors to prevent use-after-free") Signed-off-by: Sasha Levin

powerpc/xive: make xive IPI allocation NULL-safe

2026-09-14T11:40:12+00:00

[ Upstream commit f068fca7e8b7014014296b0e458ba9c5aa77f954 ] __GFP_NOFAIL should not be used in new code [1]. xive_init_ipis() allocates the xive_ipis array with __GFP_NOFAIL, which makes the subsequent NULL check unreachable dead code. Remove __GFP_NOFAIL so the allocation can fail, and make all xive_ipis access paths NULL-safe: - Return XIVE_BAD_IRQ from xive_ipi_cpu_to_irq() when xive_ipis is NULL. - Set xive_ipis to NULL after kfree() in the error path to prevent use-after-free. - Guard xive_setup_cpu_ipi() and xive_cleanup_cpu_ipi() against xive_ipi_irq == XIVE_BAD_IRQ to avoid dereferencing an uninitialized or already-freed xive_ipis array. No functional change when allocation succeeds. Link: https://lore.kernel.org/all/20260725202632.dcb325658896a470df91cf57@linux-foundation.org/ [1] Fixes: 7dcc37b3eff9 ("powerpc/xive: Map one IPI interrupt per node") Signed-off-by: Gou Hao Suggested-by: Andrew Morton Suggested-by: Cédric Le Goater Suggested-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Wentao Guan Reviewed-by: jiazhenyuan Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Cédric Le Goater Reviewed-by: Andrew Morton Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727104215.184786-2-gouhao@uniontech.com Signed-off-by: Sasha Levin

powerpc: implement get_direction() in cpm2

2026-09-14T11:40:02+00:00

[ Upstream commit ca16219e9babc874349a6ac307d56523871a9137 ] The lack of get_direction() callback in this driver causes GPIOLIB to emit a warning. Implement it. Fixes: e623c4303ed1 ("gpiolib: sanitize the return value of gpio_chip::get_direction()") Signed-off-by: Christophe Leroy (CS GROUP) Reviewed-by: Bartosz Golaszewski Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/c6eb70aa0e1ba6e15f947c827006aa79edace05c.1785318836.git.chleroy@kernel.org Signed-off-by: Sasha Levin

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of by the more specific where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub)

powerpc: use sysfs_emit{_at} in sysfs show functions

2026-06-02T05:54:32+00:00

Replace sprintf() with sysfs_emit() and sysfs_emit_at() in sysfs show functions, which are preferred for formatting sysfs output because they provide safer bounds checking. While the current code only emits strings that fit easily within PAGE_SIZE, use sysfs_emit() and sysfs_emit_at() to follow secure coding best practices. This is a mechanical cleanup with a few simple edge cases: - In domains_show(), drop the redundant n < 0 check since neither sprintf() nor sysfs_emit() return negative values. - In powercap_show() and psr_show(), also drop the dead ret < 0 checks. - In ps3_fw_version_show(), normalize the output by adding a terminating newline as suggested by checkpatch. - In vio's modalias_show(), replace the deprecated strcpy() [1] followed by strlen() with sysfs_emit(). Leave validate_show() and the variable-length hv-gpci helpers unchanged since they already have explicit bounds handling, and converting those would be more than a mechanical conversion. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy Signed-off-by: Thorsten Blum Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260524130002.793476-2-thorsten.blum@linux.dev

powerpc/xive: Add warning if target CPU not found

2026-06-02T05:54:32+00:00

Add a warn_once to warn if the CPU target is not found. This could help to find about any such usecase. This is a very rare case, which either means mask was empty or atomic update failed for all online CPUs. So it is worth printing that path for potential fix. Signed-off-by: Shrikanth Hegde Reviewed-by: Yury Norov Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260427044715.559137-5-sshegde@linux.ibm.com

Merge tag 'powerpc-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

2026-04-15T00:10:15+00:00

Pull powerpc updates from Madhavan Srinivasan: - powerpc support for huge pfnmaps - Cleanups to use masked user access - Rework pnv_ioda_pick_m64_pe() to use better bitmap API - Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC - Backup region offset update to eflcorehdr - Fixes for wii/ps3 platform - Implement JIT support for private stack in powerpc - Implement JIT support for fsession in powerpc64 trampoline - Add support for instruction array and indirect jump in powerpc - Misc selftest fixes and cleanups Thanks to Abhishek Dubey, Aditya Gupta, Alex Williamson, Amit Machhiwal, Andrew Donnellan, Bartosz Golaszewski, Cédric Le Goater, Chen Ni, Christophe Leroy (CS GROUP), Hari Bathini, J. Neuschäfer, Mukesh Kumar Chaurasiya (IBM), Nam Cao, Nilay Shroff, Pavithra Prakash, Randy Dunlap, Ritesh Harjani (IBM), Shrikanth Hegde, Sourabh Jain, Vaibhav Jain, Venkat Rao Bagalkote, and Yury Norov (NVIDIA) * tag 'powerpc-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (47 commits) mailmap: Add entry for Andrew Donnellan powerpc32/bpf: fix loading fsession func metadata using PPC_LI32 selftest/bpf: Enable gotox tests for powerpc64 powerpc64/bpf: Add support for indirect jump selftest/bpf: Enable instruction array test for powerpc powerpc/bpf: Add support for instruction array powerpc32/bpf: Add fsession support powerpc64/bpf: Implement fsession support selftests/bpf: Enable private stack tests for powerpc64 powerpc64/bpf: Implement JIT support for private stack powerpc: pci-ioda: Optimize pnv_ioda_pick_m64_pe() powerpc: pci-ioda: use bitmap_alloc() in pnv_ioda_pick_m64_pe() powerpc/net: Inline checksum wrappers and convert to scoped user access powerpc/sstep: Convert to scoped user access powerpc/align: Convert emulate_spe() to scoped user access powerpc/ptrace: Convert gpr32_set_common_user() to scoped user access powerpc/futex: Use masked user access powerpc/audit: Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC cpuidle: powerpc: avoid double clear when breaking snooze powerpc/ps3: spu.c: fix enum and Return kernel-doc warnings ...

powerpc/xive: simplify xive_spapr_debug_show()

2026-04-09T17:28:05+00:00

The function creates temporary buffer to convert xibm->bitmap to a human-readable list before passing it to seq_printf. Drop it and print the list by seq_printf() directly with the "%*pbl" specifier. Reviewed-by: Shrikanth Hegde Acked-by: Madhavan Srinivasan for powerpc patch Signed-off-by: Yury Norov

powerpc/xive: rework xive_find_target_in_mask()

2026-04-01T03:51:04+00:00

Switch the function to using modern cpumask API and drop most of the housekeeping code. Notice, if first >= nr_cpu_ids, for_each_cpu_wrap() iterator behaves just like for_each_cpu(), i.e. begins from 0. So even if WARN_ON() is triggered, no special handling is needed. Signed-off-by: Yury Norov Tested-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Shrikanth Hegde Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260319033647.881246-3-ynorov@nvidia.com