summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-03media: ti: vpe: #include <linux/platform_device.h> explicitlyUwe Kleine-König (The Capable Hub)
The driver uses several symbols and structs defined in that header. The header is currently included transitively via "vip.h" -> <media/v4l2-ctrls.h> -> <media/media-request.h> -> <media/media-device.h> -> <linux/platform_device.h> which seems to be on the lower end of the scale between random and reliable. Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Link: https://patch.msgid.link/9f2e0e001eec087f00ac2c5af2de2e8f6d0978c1.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03ata: libata-scsi: limit simulated SCSI command copy to response lengthKaruna Ramkumar
The function ata_scsi_rbuf_fill() is used to copy the response of emulated SCSI commands from ata_scsi_rbuf to the SCSI command's scatterlist. Currently, sg_copy_from_buffer() is called with the size argument set to ATA_SCSI_RBUF_SIZE (2048 bytes). Since ata_scsi_rbuf is zeroed out before the simulation actor is invoked, copying the full buffer size causes the remainder of the SCSI command's transfer buffer (beyond the actual response length 'len') to be overwritten with zeroes. This clobbers any pre-existing sentinel values or data in the caller's buffer tail, even though the correct residual count is reported via scsi_set_resid(). Fix this by passing the actual response length 'len' as the copy size to sg_copy_from_buffer(), ensuring that the tail of the caller's buffer remains untouched. Also, add a defensive check to ensure that the actor does not return a length exceeding the static buffer capacity. If this occurs, trigger a WARN_ON(), fail the command with an aborted command error, and return immediately without copying any data. The fix was tested by invoking an SCSI SG_IO INQUIRY on an ATA disk on vanilla build, and build with the fix. Confirmed that the input buffer's tail end remains unmodified with the fix. Fixes: 5251ae224d8d ("ata: libata-scsi: Return residual for emulated SCSI commands") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Karuna Ramkumar <rkaruna@google.com> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03ata: pata_pxa: Fix DMA channel leak on probe errorWentao Liang
When dmaengine_slave_config() fails, the DMA channel acquired by dma_request_chan() is not released before returning the error, leaking the channel reference. Fix by adding dma_release_channel() in the error path. The ata_host_activate() error path already correctly releases the DMA channel. Cc: stable@vger.kernel.org Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Reviewed-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03ata: sata_gemini: unwind clocks on IDE pinctrl errorsMyeonghun Pak
gemini_sata_bridge_init() prepares and enables both SATA PCLKs, then disables them again while keeping the clocks prepared for later bridge start and stop operations. If gemini_setup_ide_pins() fails after that, gemini_sata_probe() returns directly and skips the existing out_unprep_clk unwind path. Route the IDE pinctrl failure through out_unprep_clk so the clocks prepared by gemini_sata_bridge_init() are unprepared before probe fails. Fixes: d872ced29d5f ("ata: sata_gemini: Introduce explicit IDE pin control") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03ata: libata-core: Reject an invalid concurrent positioning ranges countBryam Vargas
ata_dev_config_cpr() takes the number of range descriptors from buf[0] of the concurrent positioning ranges log (up to 255), which the device reports independently of the log size in the GPL directory. The count is then walked at a fixed 32-byte stride in two places with no bound: the log read here, and the INQUIRY VPD page B9h emitter, which writes one descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device reporting a count larger than its own log overflows the read buffer (up to 7704 bytes past a 512-byte slab), and a count above 62 overflows the response buffer on the emit side. Bound the count once, on probe, against both the log the device returned and the number of descriptors the VPD B9h response buffer can hold (ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range count with a warning; this keeps the emitter in bounds with no separate change there. Suggested-by: Damien Le Moal <dlemoal@kernel.org> Fixes: fe22e1c2f705 ("libata: support concurrent positioning ranges log") Fixes: c745dfc541e7 ("libata: fix reading concurrent positioning ranges log") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Reviewed-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSDBryam Vargas
The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Reviewed-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 17aa:b736William Hansen-Baird
RTL8723BE outputs a large amount of PCIe AER errors during and after boot, even before probe and when driver is never loaded. This causes significant system slowdown. The errors are the same as reported by commit 77a6407c6ab2 ("wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723") Add the RTL8723BE with subsystem ID 17aa:b736 to the rtl_aspm_quirks table to stop the AER errors. AER errors can still be present prior to pci probe, as the device by default may have ASPM enabled. Testing on a Razer Blade 14 2017 which shipped from the OEM equipped with an RTL8723BE card with this subsystem ID confirms that this patch resolves the AER flood and allows the wireless card to function normally once the driver takes over. Signed-off-by: William Hansen-Baird <william.hansen.baird@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260630141553.785769-4-william.hansen.baird@gmail.com
2026-07-03wifi: rtlwifi: convert pci if-statement to ID tableWilliam Hansen-Baird
Refactor the ASUSTek quirk logic from an if-statement to a standard rtl_aspm_quirks pci_device_id table. This allows future devices with the same quirk to be added more easily while avoiding a large if-chain. Signed-off-by: William Hansen-Baird <william.hansen.baird@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260630141553.785769-3-william.hansen.baird@gmail.com
2026-07-03wifi: rtlwifi: fix disabling of ASPM for RTL8723BE with AER floodingWilliam Hansen-Baird
commit 77a6407c6ab2 ("wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723") adds code which sets ppsc->support_aspm to false in _rtl_pci_update_default_setting() in order to disable ASPM. This does not, however, disable ASPM. Rather, it disables driver control of ASPM, and blocks calls to rtl_pci_enable_aspm() and rtl_pci_disable_aspm(). In some cases, the pci device supplied to the probe function has ASPM enabled. The code would therefore not disable ASPM, as it means to, but rather just leave it enabled. This was discovered through testing on a Razer Blade 14 2017. Implement a new __rtl_pci_disable_aspm(hw) function which does not check ppsc->support_aspm before disabling and call it from rtl_pci_disable_aspm(). Then move the code added in the previous commit to rtl_pci_init_aspm() to allow adding a call to __rtl_pci_disable_aspm(hw). This makes sure ASPM is disabled while still disabling driver control of ASPM to block it from being enabled later. Signed-off-by: William Hansen-Baird <william.hansen.baird@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260630141553.785769-2-william.hansen.baird@gmail.com
2026-07-03wifi: rtw89: fix HE extended capability length checkPengpeng Hou
rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen >= 11 before reading data[10]. Fixes: 8d540f9d2916 ("wifi: rtw89: disable 26-tone RU HE TB PPDU transmissions") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/2026063009025530.2-ccfa108-0024-wifi-rtw89-fix-HE-extended--pengpeng@iscas.ac.cn
2026-07-03wifi: rtw89: check return values in rtw89_ops_start_ap()Dmitry Morgun
Several functions called in rtw89_ops_start_ap() may fail to allocate skb or fail to send H2C command to firmware, returning -ENOMEM or an error code. Their return values are ignored, so subsequent commands are executed with incorrect state. Check the return values and propagate errors. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a52e4f2ce0f5 ("rtw89: implement ieee80211_ops::start_ap and stop_ap") Signed-off-by: Dmitry Morgun <d.morgun@ispras.ru> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260629094452.8709-1-d.morgun@ispras.ru
2026-07-03wifi: rtw89: wow: only WiFi 6 chips initialize RF registers in WoWLAN modeChih-Kang Chang
Only the WiFi 6 chips need to initialize RF register when WoWLAN download FW for some power save issue. Applying the same initialization flow to WiFi 7 chips might trigger the error 'RF parameters exceed size. path=1, idx=1500.'. This happens because normal mode uses rtw89_phy_config_rf_reg_v1(), which skips registers with addresses below 0x100. However, WoWLAN mode uses rtw89_phy_config_rf_reg_noio(), and WiFi 7 chips do not satisfy the rtw89_chip_rf_v1() condition. As a result, more RF registers are configured, causing the size overflow error. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-11-pkshih@realtek.com
2026-07-03wifi: rtw89: wow: add QoS control field to WoWLAN ARP response for MLOChin-Yen Lee
Some MLO APs expect WoWLAN ARP response frames to be transmitted as QoS data frames and may discard frames that do not contain a QoS Control field. Add a QoS Control field and use the QoS Data subtype when generating WoWLAN ARP responses for MLD vifs. Keep the existing frame format unchanged for non-MLO connections. This allows WoWLAN ARP responses to be accepted by MLO APs while preserving compatibility with legacy APs. Signed-off-by: Chin-Yen Lee <timlee@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-10-pkshih@realtek.com
2026-07-03wifi: rtw89: wow: use MLD address in WoWLAN ARP replies for MLO stationsChin-Yen Lee
Currently, WoWLAN ARP replies for MLO stations use the link address in the ARP hardware address fields. As a result, peers may learn the link address from the ARP reply and use it as the destination address for subsequent traffic. Some APs may not forward frames addressed to the link address, causing connectivity issues. Use the MLD address instead when generating WoWLAN ARP replies so peers learn the correct address for MLO stations. Signed-off-by: Chin-Yen Lee <timlee@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-9-pkshih@realtek.com
2026-07-03wifi: rtw89: fw: fix link ID filling for LPS MLO common infoZong-Zhe Yang
The link ID field in H2C command of LPS MLO common info is incorrectly filled with the PHY index. Fix it with the target link ID. Fixes: 20380a039ddd ("wifi: rtw89: phy: add H2C command to send detail RX gain and link parameters for PS mode") Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-8-pkshih@realtek.com
2026-07-03wifi: rtw89: pci: disable phy error flag related to refclkChih-Kang Chang
On some platforms, refclk is not available up to 15 ms after entering suspend. The delayed clock cause the hardware to detect falsely error and trigger an unexpected hardware reset. Disable the phy error flag related to refclk to fix it. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-7-pkshih@realtek.com
2026-07-03wifi: rtw89: disable sniffer mode in RX filter when initialization for Wi-Fi ↵Chih-Kang Chang
7 chips Sniffer mode is enabled by default in the RX filter on Wi-Fi 7 chips, which causes all packets to be received regardless of the ADDR_CAM lookup result. This may result in unexpected packets being received. Therefore, disable it by default. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-6-pkshih@realtek.com
2026-07-03wifi: rtw89: drop packet offload entry on H2C addition failure to avoid scan ↵Dian-Syuan Yang
issue A special case is when C2H done ack has been completed, but the corresponding packet offload response has not actually been received, which causes the add packet offload to fail. In this state, firmware treats the entry as added, so subsequent add requests for the same id are rejected as duplicates. To recover from this, send a delete packet offload H2C command to roll back the normal state. It has been tested and verified to have no functional side effect. Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-5-pkshih@realtek.com
2026-07-03wifi: rtw89: fw: lower debug level for UDM1 debug registerPing-Ke Shih
The UDM1 is user define message to record count of H2C command sent by driver and received by firmware. Normally, this value should be zero. Otherwise, throw a warning. For the new chip RTL8922DE, its default value is not zero, causing a warning at first time probe. Since this is a debug purpose and the value will be set to zero right after this checking, lower the debug level. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-4-pkshih@realtek.com
2026-07-03wifi: rtw89: mac: pass chip version to firmwarePing-Ke Shih
Set chip version to register shared with firmware before downloading firmware, so firmware can run proper flow according to the version. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-3-pkshih@realtek.com
2026-07-03wifi: rtw89: mac: finish active TX immediately without waiting for DMACPing-Ke Shih
Currently active TX only finishes after ensuring PCIE and DMAC become idle. However, the waiting time might be long. Since the packet is already transmitted over the air, update the registers to finish active TX immediately, regardless of the PCIE/DMAC status. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-2-pkshih@realtek.com
2026-07-03platform/chrome: sensorhub: Fix memory overread in ring handlerTzung-Bi Shih
`max_response` and `sensor_num` are read from different EC commands: - `max_response` is from cros_ec_get_proto_info(). ec_dev->max_response = info->max_response_packet_size - sizeof(struct ec_host_response); - `sensor_num` is from cros_ec_get_sensor_count(). sensor_num = cros_ec_get_sensor_count(ec); With a malfunctioning EC firmware, it is possible that the `msg->insize` (i.e., `fifo_info_length` in the context) could be clamped in cros_ec_cmd_xfer() because `msg->insize` is greater than `max_response`. int fifo_info_length = sizeof(struct ec_response_motion_sense_fifo_info) + sizeof(u16) * sensorhub->sensor_num; This means the number of read bytes could be less than expected. As a result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler() overreads the `resp->fifo_info` buffer. Check the return value of cros_ec_cmd_xfer_status() and abort if the number of bytes read does not match the expected length. Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support") Reviewed-by: Tomasz Figa <tfiga@chromium.org> Link: https://lore.kernel.org/r/20260702082745.1014968-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-07-03wifi: rtw89: coex: Add RTL8922D chip stringChing-Te Ku
Add string for logic using and show logs. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-11-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Add Wi-Fi firmware 0.35.94.1 support for RTL8922DChing-Te Ku
The firmware 0.35.94.1 included several new features. Wi-Fi TX power setting offload to firmware. Including dual BT / dual Wi-Fi MAC related configurations. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-10-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Renaming drvinfo_type to drvinfo_verChing-Te Ku
It's more closing to the original meaning. It is defined for rearranging driver info index by firmware support version. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-9-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Add TX/RX RF parameter format version 9Ching-Te Ku
In order to support external Zigbee/Thread/Bluetooth etc module, the version 8 add the parameter for the case. And also update the related configuration function. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-8-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Refine third party module related coexistenceChing-Te Ku
The incoming chip reserved several IO ports to coexist with the other vendor's stand along chips. In order to configured them easier add the structure. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-7-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Move Bluetooth related counters to BT infoChing-Te Ku
In order to support dual Bluetooth chip, move Bluetooth counters to BT info. Because the two Bluetooth need to collect their own counters. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-6-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Extend bt_slot_req for dual MAC wifiChing-Te Ku
This variable is for asking driver occupied Bluetooth traffic slot while wifi is running at multi-port mode. Example like station + AP. The time slot is separated by wifi driver under these wifi modes. And to ensure Bluetooth performance, Coex will advice the Bluetooth slot length to driver. And each MAC is able to run multi-port mode, so extend the variable's index. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-5-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Move wifi related counters to wifi infoChing-Te Ku
Move wifi related counters to wifi main info, it is to facilitate the after modification for dual MAC wifi structure. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-4-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: offset current BT info to BT0 for dual BT configurationChing-Te Ku
In order to compatible with single/dual Bluetooth structure in one branch, offset the currently using BT info structure to BT-0. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-3-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: force to exit Wi-Fi LPS while Bluetooth profile existChing-Te Ku
Wi-Fi can not reach LPS leave threshold while Wi-Fi only throughput not good & Bluetooth share bandwidth. Add logic to let force leave Wi-Fi LPS while Bluetooth profile exist. Update COEX version to 9.0.1. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-2-pkshih@realtek.com
2026-07-03wifi: rtw88: Enable receiving control frames in monitor modeBitterblue Smith (S.E.A. Datentechnik GmbH)
By default RTL8723D, RTL8703B, RTL8812A, RTL8821A, and RTL8814A are configured to filter out all control frames except PS-Poll, even in monitor mode. Handle FIF_CONTROL in rtw_ops_configure_filter(). When it's set, configure REG_RXFLTMAP1 to let all control frames through. When it's unset, restore the original value. Because some drivers configure REG_RXFLTMAP1 differently, keep track of its value in a new member of struct rtw_hal. Signed-off-by: Bitterblue Smith (S.E.A. Datentechnik GmbH) <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/2a52d718-9e46-47f2-84a1-d8e7b1ed89a8@gmail.com
2026-07-03wifi: rtl8xxxu: 8723bu: remove reference of non-existing firmware ↵Ping-Ke Shih
rtl8723bu_bt.bin A report from [1] that firmware is missing in linux-firmware repository. However, there is no specific firmware for RTL8723BU for Bluetooth enabled. Remove the unnecessary reference of firmware file. [1] https://github.com/rtlwifi-linux/rtlwifi-next/issues/20 Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260622015439.9621-1-pkshih@realtek.com
2026-07-03wifi: rtlwifi: rtl8192du: check QoS TID before indexing tidsRunyu Xiao
rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15. rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc(). This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'. Fixes: 8321424134a4 ("wifi: rtlwifi: Add rtl8192du/trx.{c,h}") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260620025632.46206-1-runyu.xiao@seu.edu.cn
2026-07-03wifi: rtw88: pci: fix resource leak on failed NAPI setupDawei Feng
rtw_pci_probe() allocates PCI resources through rtw_pci_setup_resource() before it sets up NAPI. If rtw_pci_napi_init() fails, the error path jumps straight to err_pci_declaim and skips rtw_pci_destroy(), leaving the PCI resources allocated by rtw_pci_setup_resource() behind. Add a dedicated cleanup label for the NAPI setup failure path so probe destroys the PCI resources. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing current mainline kernels. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings. As we do not have a suitable rtw88 PCI board to test with, no runtime testing was able to be performed. Fixes: d0bcb10e7b94 ("wifi: rtw88: Un-embed dummy device") Cc: stable@vger.kernel.org Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260617013502.114057-1-dawei.feng@seu.edu.cn
2026-07-03wifi: rtw88: 8822c: replace msleep() with fsleep() for DPK delaysChen Jung Ku
Replace msleep() with fsleep(), because msleep() may oversleep to as much as 20 ms when used for a 10 ms delay. According to the kernel documentation, fsleep() is more suitable and aligns better with modern kernel style. Signed-off-by: Chen Jung Ku <ku.loong@gapp.nthu.edu.tw> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260613170434.23645-1-ku.loong@gapp.nthu.edu.tw
2026-07-03wifi: rtw89: use str_enable_disable() helperPanagiotis Petrakopoulos
Replace "enable"/"disable" strings in ternary expressions with the str_enable_disable() helper from <linux/string_choices.h>. This covers the rfkill state log in rtw89_core_rfkill_poll() and the DPK on/off log in _dpk_onoff(). No functional change intended. Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260612223012.504886-1-npetrakopoulos2003@gmail.com
2026-07-03wifi: rtw89: fw: correct preload field of w2 in ↵Wentao Guan
rtw89_fw_h2c_default_cmac_tbl_be() BE_CCTL_INFO_W2_PRELOAD_ENABLE is for h2c->w2, not h2c->w1. These will cause h2c->w1 wrong overlap by w2 and w2 not initialized. Fixes: c73607b3a8ef ("wifi: rtw89: fw: add CMAC H2C command to initialize default value for RTL8922D") Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260611082021.46650-1-guanwentao@uniontech.com
2026-07-03wifi: rtw88: 8822b: Don't process RF path C in query_phy_status_page1Bitterblue Smith
Replace <= with < in the loop in query_phy_status_page1(). It was processing data related to RF path C, which this chip doesn't have. The only bad effect seems to be that the phy_info file in debugfs was printing unexpected values for RF path C. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/9c4beb36-2954-4db0-844a-74ba5eacf21b@gmail.com
2026-07-03wifi: rtw88: 8822c: Don't process RF path C in query_phy_status_page{0,1}Bitterblue Smith
Replace <= with < in the loops in query_phy_status_page{0,1}(). They were processing data related to RF path C, which this chip doesn't have. The only bad effect seems to be that the phy_info file in debugfs was printing unexpected values for RF path C. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/ee30b95f-bc68-4711-9b15-cf5fd23c3c48@gmail.com
2026-07-03wifi: rtlwifi: rtl8723be: Remove unnecessary irq save/restore in hw_init()William Hansen-Baird
rtl8723be hw_init() calls local_save_flags(flags) followed by local_irq_enable(). Later, local_irq_restore(flags) is called. This causes warnings from Lockdep on boot and modprobe, as local_irq_restore(flags) should only be called while irqs are disabled. The warning was introduced to detect this class of bug in [1]. With testing I found that all paths which call hw_init() have irqs already enabled for rtl8723be. Furthermore, the calls were originally added for the rtl8192ce in commit f78bccd79ba3 ("rtlwifi: rtl8192ce: Fix too long disable of IRQs") before later being added to most other rtlwifi drivers. Commit d3feae41a347 ("rtlwifi: Update power-save routines for 062814 driver") then replaces the call to spin_lock_irqsave() before hw_init(), and thus the codepath which caused irqs to be disabled in hw_init and prompted the original commit has been removed. The same irq save/restore pattern is also present in the hw_init() of rtl8192ce, rtl8723ae, rtl8188ee, rtl8192se and rtl8192cu, however I don't have the hardware to test them, so I did not include them in my changes. Tested on a Razer Blade 14 2017. Example of output from Lockdep prior to fix: raw_local_irq_restore() called with IRQs enabled ... Call Trace: <TASK> rtl8723be_hw_init+0x5992/0x7220 [rtl8723be] ? static_obj+0x61/0xa0 rtl_pci_start+0x222/0x5c0 [rtl_pci] rtl_op_start+0x128/0x1a0 [rtlwifi] ? __kasan_check_read+0x11/0x20 drv_start+0x16c/0x550 [mac80211] ... irq event stamp: 887679 hardirqs last enabled at (887689): [<ffffffff96511170>] __up_console_sem+0x90/0xa0 hardirqs last disabled at (887698): [<ffffffff96511155>] __up_console_sem+0x75/0xa0 softirqs last enabled at (887670): [<ffffffff962f4675>] __irq_exit_rcu+0x175/0x2f0 softirqs last disabled at (887649): [<ffffffff962f4675>] __irq_exit_rcu+0x175/0x2f0 ---[ end trace 0000000000000000 ]--- [1] https://lore.kernel.org/all/20210111153707.10071-1-mark.rutland@arm.com/ Signed-off-by: William Hansen-Baird <william.hansen.baird@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260609095359.2964193-1-william.hansen.baird@gmail.com
2026-07-03wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()Dan Carpenter
This > comparison should be >= to avoid an out of bounds access. Fixes: 419ed7f4a053 ("wifi: rtw89: debug: extend bb_info with TX status and PER") Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/aia25i0ds3B6QF6c@stanley.mountain
2026-07-03wifi: rtw89: fw: support scan offload v2 for WiFi 7 chipsPing-Ke Shih
The format of scan offload v2 is to extend fields to consider channel noise as a factor to adjust dwell time of certain channels. Leave empty for now to ignore this factor. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260525070735.27659-3-pkshih@realtek.com
2026-07-03wifi: rtw89: fw: add first set of firmware features by version for RTL8922DPing-Ke Shih
The firmware features including version of command/event format are maintained by this table, which enables features by firmware version. Define the first feature set accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260525070735.27659-2-pkshih@realtek.com
2026-07-03gpu: nova-core: remove local bitfield macroAlexandre Courbot
This module is now orphaned code, superseded by a kernel-global implementation, so remove it. Reviewed-by: Eliot Courtney <ecourtney@nvidia.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260701-nova-bitfield-v2-2-2e949bf1836c@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-03gpu: nova-core: convert to kernel bitfield macroAlexandre Courbot
Replace uses of the Nova-local `bitfield!` macro with the kernel one. Reviewed-by: Eliot Courtney <ecourtney@nvidia.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260701-nova-bitfield-v2-1-2e949bf1836c@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-02Merge tag 'vfio-v7.2-rc2' of https://github.com/awilliam/linux-vfioLinus Torvalds
Pull VFIO fixes from Alex Williamson: "Mostly straightforward fixes here, inconsistent runtime PM handling due to global device policies, bitfield races, unwind path gaps, teardown ordering, and a misplaced library flag. - Fix racy bitfield updates in vfio-pci-core and the mlx5 vfio-pci variant driver with a binary split between setup/release and runtime modified flags. These were noted across several Sashiko reviews as pre-existing issues (Alex Williamson) - Fix runtime PM inconsistency where the vfio-pci driver module_init could modify the idle PM policy of existing devices through globals managed in vfio-pci-core, leading to unbalanced runtime PM operations (Alex Williamson) - Restore mutability of writable vfio-pci module options by further pulling policy globals out of vfio-pci-core, to instead be latched per device at device init. Provide visibility of the per device latched values through debugfs (Alex Williamson) - Fix missing VGA arbiter uninit callback in unwind path (Alex Williamson) - Reorder device debugfs removal before device_del() to avoid gap where debugfs is available with stale devres pointers (Alex Williamson) - Move UUID library linking flag from vfio selftest Makefile into libvfio.mk to avoid exposing such dependencies when linking with KVM selftests (Sean Christopherson)" * tag 'vfio-v7.2-rc2' of https://github.com/awilliam/linux-vfio: vfio: selftests: Add luuid to libvfio.mk's list of libraries, not to the Makefile vfio/pci: Expose latched module parameter policy in debugfs vfio: Remove device debugfs before releasing devres vfio/pci: Latch all module parameters per device vfio/mlx5: Fix racy bitfields and tighten struct layout vfio/pci: Fix racy bitfields and tighten struct layout vfio/pci: Release the VGA arbiter client on register_device() failure vfio/pci: Latch disable_idle_d3 per device
2026-07-03iio: adc: ti-adc081c: use dev_err_probe() for probe time errorPrashant Rahul
This simplifies error handling and ensures consistent error reporting. Signed-off-by: Prashant Rahul <prashantrahul23@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-03Merge tag 'drm-misc-fixes-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v7.2-rc2: - Fix potential null pointer dereference in dma-buf. - Handle 0 in dma_fence_dedup_array. - Use the correct callback in dma_fence_timeline_name. - Fix device removal handling in amdxdna. - kernel-doc fixes. - Include header fix for drm_ras.h - Handle edids better in virtio. - Use the clk_bulk api for error handling in malidp. - More clk handling fixes for komeda. - panthor scheduler block fallout fixes. - panthor unplug fixes. - other panthor fixes. - Fix unnecessary WARN_ON in topology probe after teardown. - Add refcount to amdxdna job to fix use-after free. - Fix increasing args->size in ioctl's of drm/imagination. - Handle stride correctly in pvr_set_uobj_array. - Only call imagination's drm_sched_entity_fini once. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/786bdc92-0ce3-4c0f-9668-b0fa8a0047ea@linux.intel.com
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-14 06:11:50 +0000