Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...
authorLinus Torvalds <torvalds@linux-foundation.org>
Tue, 25 Aug 2026 16:38:50 +0000 (09:38 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Tue, 25 Aug 2026 16:38:50 +0000 (09:38 -0700)
Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...

44 files changed:
1  2 
.mailmap
Documentation/devicetree/bindings/vendor-prefixes.yaml
Documentation/hwmon/index.rst
MAINTAINERS
drivers/android/binder/netlink.rs
drivers/android/binder/process.rs
drivers/android/binder/rust_binder_main.rs
drivers/fpga/dfl-fme-perf.c
drivers/hwmon/Kconfig
drivers/hwmon/Makefile
drivers/hwtracing/ptt/hisi_ptt.c
drivers/iio/adc/ad7173.c
drivers/misc/fastrpc.c
drivers/misc/pci_endpoint_test.c
drivers/nvmem/core.c
drivers/nvmem/internals.h
drivers/pci/endpoint/functions/pci-epf-mhi.c
drivers/power/supply/ab8500_btemp.c
drivers/power/supply/ab8500_charger.c
drivers/power/supply/ab8500_fg.c
drivers/power/supply/axp20x_ac_power.c
drivers/power/supply/axp20x_usb_power.c
drivers/power/supply/axp288_fuel_gauge.c
drivers/power/supply/cpcap-battery.c
drivers/power/supply/cpcap-charger.c
drivers/power/supply/generic-adc-battery.c
drivers/power/supply/lp8788-charger.c
drivers/power/supply/max17040_battery.c
drivers/power/supply/mp2629_charger.c
drivers/power/supply/mt6370-charger.c
drivers/power/supply/qcom_smbx.c
drivers/power/supply/rn5t618_power.c
drivers/power/supply/sc27xx_fuel_gauge.c
drivers/power/supply/twl4030_charger.c
drivers/power/supply/twl6030_charger.c
lib/vsprintf.c
rust/bindings/bindings_helper.h
rust/helpers/helpers.c
rust/kernel/miscdevice.rs
rust/kernel/sync/poll.rs
rust/kernel/task.rs
rust/uapi/uapi_helper.h
sound/soc/samsung/aries_wm8994.c
sound/soc/stm/stm32_adfsdm.c

diff --cc .mailmap
Simple merge
@@@ -254,9 -251,9 +254,10 @@@ Hardware Monitoring Kernel Driver
     smsc47b397
     smsc47m192
     smsc47m1
+    socfpga-hwmon
     sparx5-temp
     spd5118
 +   sq24860
     stpddc60
     surface_fan
     sy7636a-hwmon
diff --cc MAINTAINERS
Simple merge
index 0000000,beb7ea2..f34e100
mode 000000,100644..100644
--- /dev/null
@@@ -1,0 -1,117 +1,117 @@@
 -    &crate::THIS_MODULE,
+ // SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)
+ /* Based on: Documentation/netlink/specs/binder.yaml */
+ 
+ #![allow(unreachable_pub, clippy::wrong_self_convention)]
+ use kernel::{
+     net::netlink::{
+         Family,
+         GenlMsg,
+         MulticastGroup,
+         NetlinkSkBuff, //
+     },
+     prelude::*, //
+ };
+ 
+ pub static BINDER_NL_FAMILY: Family = Family::const_new(
++    kernel::module::this_module::<crate::LocalModule>(),
+     kernel::uapi::BINDER_FAMILY_NAME,
+     kernel::uapi::BINDER_FAMILY_VERSION,
+     &BINDER_NL_FAMILY_MCGRPS,
+ );
+ 
+ static BINDER_NL_FAMILY_MCGRPS: [MulticastGroup; 1] = [MulticastGroup::const_new(c"report")];
+ 
+ /// A multicast event sent to userspace subscribers to notify them about
+ /// binder transaction failures. The generated report provides the full
+ /// details of the specific transaction that failed. The intention is for
+ /// programs to monitor these events and react to the failures as needed.
+ pub struct Report {
+     skb: GenlMsg,
+ }
+ 
+ impl Report {
+     /// Create a new multicast message.
+     pub fn new(
+         size: usize,
+         portid: u32,
+         seq: u32,
+         flags: kernel::alloc::Flags,
+     ) -> Result<Self, kernel::alloc::AllocError> {
+         const BINDER_CMD_REPORT: u8 = kernel::uapi::BINDER_CMD_REPORT as u8;
+         let skb = NetlinkSkBuff::new(size, flags)?;
+         let skb = skb.genlmsg_put(portid, seq, &BINDER_NL_FAMILY, BINDER_CMD_REPORT)?;
+         Ok(Self { skb })
+     }
+ 
+     /// Broadcast this message.
+     pub fn multicast(self, portid: u32, flags: kernel::alloc::Flags) -> Result {
+         self.skb.multicast(&BINDER_NL_FAMILY, portid, 0, flags)
+     }
+ 
+     /// Check if this message type has listeners.
+     pub fn has_listeners() -> bool {
+         BINDER_NL_FAMILY.has_listeners(0)
+     }
+ 
+     /// The enum binder_driver_return_protocol returned to the sender.
+     pub fn error(&mut self, val: u32) -> Result {
+         const BINDER_A_REPORT_ERROR: c_int = kernel::uapi::BINDER_A_REPORT_ERROR as c_int;
+         self.skb.put_u32(BINDER_A_REPORT_ERROR, val)
+     }
+ 
+     /// The binder context where the transaction occurred.
+     pub fn context(&mut self, val: &CStr) -> Result {
+         const BINDER_A_REPORT_CONTEXT: c_int = kernel::uapi::BINDER_A_REPORT_CONTEXT as c_int;
+         self.skb.put_string(BINDER_A_REPORT_CONTEXT, val)
+     }
+ 
+     /// The PID of the sender process.
+     pub fn from_pid(&mut self, val: u32) -> Result {
+         const BINDER_A_REPORT_FROM_PID: c_int = kernel::uapi::BINDER_A_REPORT_FROM_PID as c_int;
+         self.skb.put_u32(BINDER_A_REPORT_FROM_PID, val)
+     }
+ 
+     /// The TID of the sender thread.
+     pub fn from_tid(&mut self, val: u32) -> Result {
+         const BINDER_A_REPORT_FROM_TID: c_int = kernel::uapi::BINDER_A_REPORT_FROM_TID as c_int;
+         self.skb.put_u32(BINDER_A_REPORT_FROM_TID, val)
+     }
+ 
+     /// The PID of the recipient process. This attribute may not be present
+     /// if the target could not be determined.
+     pub fn to_pid(&mut self, val: u32) -> Result {
+         const BINDER_A_REPORT_TO_PID: c_int = kernel::uapi::BINDER_A_REPORT_TO_PID as c_int;
+         self.skb.put_u32(BINDER_A_REPORT_TO_PID, val)
+     }
+ 
+     /// The TID of the recipient thread. This attribute may not be present
+     /// if the target could not be determined.
+     pub fn to_tid(&mut self, val: u32) -> Result {
+         const BINDER_A_REPORT_TO_TID: c_int = kernel::uapi::BINDER_A_REPORT_TO_TID as c_int;
+         self.skb.put_u32(BINDER_A_REPORT_TO_TID, val)
+     }
+ 
+     /// When present, indicates the failed transaction is a reply.
+     pub fn is_reply(&mut self) -> Result {
+         const BINDER_A_REPORT_IS_REPLY: c_int = kernel::uapi::BINDER_A_REPORT_IS_REPLY as c_int;
+         self.skb.put_flag(BINDER_A_REPORT_IS_REPLY)
+     }
+ 
+     /// The bitmask of enum transaction_flags from the transaction.
+     pub fn flags(&mut self, val: u32) -> Result {
+         const BINDER_A_REPORT_FLAGS: c_int = kernel::uapi::BINDER_A_REPORT_FLAGS as c_int;
+         self.skb.put_u32(BINDER_A_REPORT_FLAGS, val)
+     }
+ 
+     /// The application-defined code from the transaction.
+     pub fn code(&mut self, val: u32) -> Result {
+         const BINDER_A_REPORT_CODE: c_int = kernel::uapi::BINDER_A_REPORT_CODE as c_int;
+         self.skb.put_u32(BINDER_A_REPORT_CODE, val)
+     }
+ 
+     /// The transaction payload size in bytes.
+     pub fn data_size(&mut self, val: u32) -> Result {
+         const BINDER_A_REPORT_DATA_SIZE: c_int = kernel::uapi::BINDER_A_REPORT_DATA_SIZE as c_int;
+         self.skb.put_u32(BINDER_A_REPORT_DATA_SIZE, val)
+     }
+ }
Simple merge
@@@ -315,11 -324,8 +325,8 @@@ unsafe impl<T> Sync for AssertSync<T> {
  #[no_mangle]
  #[used]
  pub static rust_binder_fops: AssertSync<kernel::bindings::file_operations> = {
-     // SAFETY: All zeroes is safe for the `file_operations` type.
-     let zeroed_ops = unsafe { core::mem::MaybeUninit::zeroed().assume_init() };
- 
      let ops = kernel::bindings::file_operations {
 -        owner: THIS_MODULE.as_ptr(),
 +        owner: this_module::<LocalModule>().as_ptr(),
          poll: Some(rust_binder_poll),
          unlocked_ioctl: Some(rust_binder_ioctl),
          compat_ioctl: bindings::compat_ptr_ioctl,
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
diff --cc lib/vsprintf.c
Simple merge
Simple merge
Simple merge
Simple merge
@@@ -8,13 -9,14 +9,18 @@@ use crate::
      bindings,
      fs::File,
      prelude::*,
 -    sync::{CondVar, LockClassKey},
 +    sync::{
 +        rcu::synchronize_rcu,
 +        CondVar,
 +        LockClassKey, //
 +    }, //
+     types::Opaque, //
+ };
+ use core::{
+     marker::PhantomData,
+     mem::ManuallyDrop,
+     ops::Deref, //
  };
- use core::{marker::PhantomData, ops::Deref};
  
  /// Creates a [`PollCondVar`] initialiser with the given name and a newly-created lock class.
  #[macro_export]
@@@ -103,6 -106,72 +110,70 @@@ impl PinnedDrop for PollCondVar 
          unsafe { bindings::__wake_up_pollfree(self.inner.wait_queue_head.get()) };
  
          // Wait for epoll items to be properly removed.
 -        //
 -        // SAFETY: Just an FFI call.
 -        unsafe { bindings::synchronize_rcu() };
 +        synchronize_rcu();
      }
  }
 -    rcu: Opaque<bindings::callback_head>,
+ 
+ /// A [`KBox<PollCondVar>`] that uses `kfree_rcu`.
+ ///
+ /// [`KBox<PollCondVar>`]: PollCondVar
+ pub struct PollCondVarBox {
+     inner: ManuallyDrop<Pin<KBox<PollCondVarBoxInner>>>,
+ }
+ 
+ #[pin_data]
+ #[repr(C)]
+ struct PollCondVarBoxInner {
+     #[pin]
+     inner: PollCondVar,
++    rcu: Opaque<bindings::kvfree_rcu_head>,
+ }
+ 
+ // SAFETY: PollCondVar is Send
+ unsafe impl Send for PollCondVarBoxInner {}
+ // SAFETY: PollCondVar is Sync
+ unsafe impl Sync for PollCondVarBoxInner {}
+ 
+ impl PollCondVarBox {
+     /// Constructs a new boxed [`PollCondVar`].
+     pub fn new(name: &'static CStr, key: Pin<&'static LockClassKey>) -> Result<Self, AllocError> {
+         let b = KBox::pin_init(
+             pin_init!(PollCondVarBoxInner {
+                 inner <- PollCondVar::new(name, key),
+                 rcu: Opaque::uninit(),
+             }),
+             GFP_KERNEL,
+         )
+         .map_err(|_| AllocError)?;
+ 
+         Ok(PollCondVarBox {
+             inner: ManuallyDrop::new(b),
+         })
+     }
+ }
+ 
+ impl Deref for PollCondVarBox {
+     type Target = PollCondVar;
+     fn deref(&self) -> &PollCondVar {
+         &self.inner.inner
+     }
+ }
+ 
+ impl Drop for PollCondVarBox {
+     #[inline]
+     fn drop(&mut self) {
+         // SAFETY: ManuallyDrop::take ok because not already taken.
+         let boxed = unsafe { ManuallyDrop::take(&mut self.inner) };
+ 
+         // SAFETY: The code below frees the box without calling the actual destructor of the type,
+         // but it's okay because it re-implements the destructor using `kfree_rcu()` in place of
+         // `synchronize_rcu()`.
+         let ptr = KBox::into_raw(unsafe { Pin::into_inner_unchecked(boxed) });
+ 
+         // SAFETY: The pointer points at a valid `wait_queue_head`.
+         unsafe { bindings::__wake_up_pollfree((*ptr).inner.inner.wait_queue_head.get()) };
+ 
+         // SAFETY: This was allocated using `KBox::pin_init`, so it can be freed with `kvfree`.
+         unsafe { bindings::kvfree_call_rcu((*ptr).rcu.get(), ptr.cast::<ffi::c_void>()) };
+     }
+ }
@@@ -210,7 -210,14 +210,14 @@@ impl Task 
          unsafe { *ptr::addr_of!((*self.as_ptr()).pid) }
      }
  
 -    /// Returns the UID of the given task.
+     /// Returns the TGID (Thread Group ID / Process ID) of the given task.
+     pub fn tgid(&self) -> Pid {
+         // SAFETY: The tgid of a task never changes after initialization, so reading this field is
+         // not a data race.
+         unsafe { *ptr::addr_of!((*self.as_ptr()).tgid) }
+     }
+ 
 +    /// Returns the objective real UID of the given task.
      #[inline]
      pub fn uid(&self) -> Kuid {
          // SAFETY: It's always safe to call `task_uid` on a valid task.
@@@ -10,7 -11,7 +10,8 @@@
  #include <uapi/drm/nova_drm.h>
  #include <uapi/drm/panthor_drm.h>
  #include <uapi/linux/android/binder.h>
+ #include <uapi/linux/android/binder_netlink.h>
 +#include <uapi/linux/ioctl.h>
  #include <uapi/linux/mdio.h>
  #include <uapi/linux/mii.h>
  #include <uapi/linux/ethtool.h>
Simple merge
Simple merge