summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-03wifi: rtw89: drop packet offload entry on H2C addition failure to avoid scan ↵Dian-Syuan Yang
issue A special case is when C2H done ack has been completed, but the corresponding packet offload response has not actually been received, which causes the add packet offload to fail. In this state, firmware treats the entry as added, so subsequent add requests for the same id are rejected as duplicates. To recover from this, send a delete packet offload H2C command to roll back the normal state. It has been tested and verified to have no functional side effect. Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-5-pkshih@realtek.com
2026-07-03wifi: rtw89: fw: lower debug level for UDM1 debug registerPing-Ke Shih
The UDM1 is user define message to record count of H2C command sent by driver and received by firmware. Normally, this value should be zero. Otherwise, throw a warning. For the new chip RTL8922DE, its default value is not zero, causing a warning at first time probe. Since this is a debug purpose and the value will be set to zero right after this checking, lower the debug level. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-4-pkshih@realtek.com
2026-07-03wifi: rtw89: mac: pass chip version to firmwarePing-Ke Shih
Set chip version to register shared with firmware before downloading firmware, so firmware can run proper flow according to the version. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-3-pkshih@realtek.com
2026-07-03wifi: rtw89: mac: finish active TX immediately without waiting for DMACPing-Ke Shih
Currently active TX only finishes after ensuring PCIE and DMAC become idle. However, the waiting time might be long. Since the packet is already transmitted over the air, update the registers to finish active TX immediately, regardless of the PCIE/DMAC status. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260625061545.44808-2-pkshih@realtek.com
2026-07-03platform/chrome: sensorhub: Fix memory overread in ring handlerTzung-Bi Shih
`max_response` and `sensor_num` are read from different EC commands: - `max_response` is from cros_ec_get_proto_info(). ec_dev->max_response = info->max_response_packet_size - sizeof(struct ec_host_response); - `sensor_num` is from cros_ec_get_sensor_count(). sensor_num = cros_ec_get_sensor_count(ec); With a malfunctioning EC firmware, it is possible that the `msg->insize` (i.e., `fifo_info_length` in the context) could be clamped in cros_ec_cmd_xfer() because `msg->insize` is greater than `max_response`. int fifo_info_length = sizeof(struct ec_response_motion_sense_fifo_info) + sizeof(u16) * sensorhub->sensor_num; This means the number of read bytes could be less than expected. As a result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler() overreads the `resp->fifo_info` buffer. Check the return value of cros_ec_cmd_xfer_status() and abort if the number of bytes read does not match the expected length. Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support") Reviewed-by: Tomasz Figa <tfiga@chromium.org> Link: https://lore.kernel.org/r/20260702082745.1014968-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-07-03wifi: rtw89: coex: Add RTL8922D chip stringChing-Te Ku
Add string for logic using and show logs. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-11-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Add Wi-Fi firmware 0.35.94.1 support for RTL8922DChing-Te Ku
The firmware 0.35.94.1 included several new features. Wi-Fi TX power setting offload to firmware. Including dual BT / dual Wi-Fi MAC related configurations. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-10-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Renaming drvinfo_type to drvinfo_verChing-Te Ku
It's more closing to the original meaning. It is defined for rearranging driver info index by firmware support version. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-9-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Add TX/RX RF parameter format version 9Ching-Te Ku
In order to support external Zigbee/Thread/Bluetooth etc module, the version 8 add the parameter for the case. And also update the related configuration function. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-8-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Refine third party module related coexistenceChing-Te Ku
The incoming chip reserved several IO ports to coexist with the other vendor's stand along chips. In order to configured them easier add the structure. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-7-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Move Bluetooth related counters to BT infoChing-Te Ku
In order to support dual Bluetooth chip, move Bluetooth counters to BT info. Because the two Bluetooth need to collect their own counters. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-6-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Extend bt_slot_req for dual MAC wifiChing-Te Ku
This variable is for asking driver occupied Bluetooth traffic slot while wifi is running at multi-port mode. Example like station + AP. The time slot is separated by wifi driver under these wifi modes. And to ensure Bluetooth performance, Coex will advice the Bluetooth slot length to driver. And each MAC is able to run multi-port mode, so extend the variable's index. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-5-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Move wifi related counters to wifi infoChing-Te Ku
Move wifi related counters to wifi main info, it is to facilitate the after modification for dual MAC wifi structure. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-4-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: offset current BT info to BT0 for dual BT configurationChing-Te Ku
In order to compatible with single/dual Bluetooth structure in one branch, offset the currently using BT info structure to BT-0. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-3-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: force to exit Wi-Fi LPS while Bluetooth profile existChing-Te Ku
Wi-Fi can not reach LPS leave threshold while Wi-Fi only throughput not good & Bluetooth share bandwidth. Add logic to let force leave Wi-Fi LPS while Bluetooth profile exist. Update COEX version to 9.0.1. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-2-pkshih@realtek.com
2026-07-03wifi: rtw88: Enable receiving control frames in monitor modeBitterblue Smith (S.E.A. Datentechnik GmbH)
By default RTL8723D, RTL8703B, RTL8812A, RTL8821A, and RTL8814A are configured to filter out all control frames except PS-Poll, even in monitor mode. Handle FIF_CONTROL in rtw_ops_configure_filter(). When it's set, configure REG_RXFLTMAP1 to let all control frames through. When it's unset, restore the original value. Because some drivers configure REG_RXFLTMAP1 differently, keep track of its value in a new member of struct rtw_hal. Signed-off-by: Bitterblue Smith (S.E.A. Datentechnik GmbH) <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/2a52d718-9e46-47f2-84a1-d8e7b1ed89a8@gmail.com
2026-07-03wifi: rtl8xxxu: 8723bu: remove reference of non-existing firmware ↵Ping-Ke Shih
rtl8723bu_bt.bin A report from [1] that firmware is missing in linux-firmware repository. However, there is no specific firmware for RTL8723BU for Bluetooth enabled. Remove the unnecessary reference of firmware file. [1] https://github.com/rtlwifi-linux/rtlwifi-next/issues/20 Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260622015439.9621-1-pkshih@realtek.com
2026-07-03wifi: rtlwifi: rtl8192du: check QoS TID before indexing tidsRunyu Xiao
rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15. rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc(). This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'. Fixes: 8321424134a4 ("wifi: rtlwifi: Add rtl8192du/trx.{c,h}") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260620025632.46206-1-runyu.xiao@seu.edu.cn
2026-07-03wifi: rtw88: pci: fix resource leak on failed NAPI setupDawei Feng
rtw_pci_probe() allocates PCI resources through rtw_pci_setup_resource() before it sets up NAPI. If rtw_pci_napi_init() fails, the error path jumps straight to err_pci_declaim and skips rtw_pci_destroy(), leaving the PCI resources allocated by rtw_pci_setup_resource() behind. Add a dedicated cleanup label for the NAPI setup failure path so probe destroys the PCI resources. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing current mainline kernels. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings. As we do not have a suitable rtw88 PCI board to test with, no runtime testing was able to be performed. Fixes: d0bcb10e7b94 ("wifi: rtw88: Un-embed dummy device") Cc: stable@vger.kernel.org Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260617013502.114057-1-dawei.feng@seu.edu.cn
2026-07-02Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull BPF fixes from Daniel Borkmann: - Initialize task local storage before fork bails out to free the task (Jann Horn) - Fix insn_aux_data leak on verifier error path (KaFai Wan) - Reject BPF inode storage map creation when BPF LSM is uninitialized (Matt Bobrowski) - Mask pseudo pointer values in verifier logs when pointer leaks are not allowed (Nuoqi Gui) - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta) - Reject a skb-modifying SK_SKB stream parser since the latter is only meant to measure the next message (Sechang Lim) - Fix bpf_refcount_acquire to reject refcounted allocation arguments with a non-zero fixed offset (Yiyang Chen) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Prefer dirty packs for eBPF allocations bpf: Prefer packs that won't trigger an IBPB flush on allocation bpf: Skip redundant IBPB in pack allocator bpf: Restrict JIT predictor flush to cBPF x86/bugs: Enable IBPB flush on BPF JIT allocation bpf: Support for hardening against JIT spraying bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized bpf,fork: wipe ->bpf_storage before bailouts that access it bpf: Fix insn_aux_data leak on verifier err_free_env path selftests/bpf: Cover pseudo-BTF ksym log masking bpf: Mask pseudo pointer values in verifier logs selftests/bpf: Cover refcount acquire node offsets bpf: Reject offset refcount acquire arguments selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser bpf, sockmap: reject a packet-modifying SK_SKB stream parser selftests/bpf: don't modify the skb in the strparser parser prog
2026-07-03wifi: rtw88: 8822c: replace msleep() with fsleep() for DPK delaysChen Jung Ku
Replace msleep() with fsleep(), because msleep() may oversleep to as much as 20 ms when used for a 10 ms delay. According to the kernel documentation, fsleep() is more suitable and aligns better with modern kernel style. Signed-off-by: Chen Jung Ku <ku.loong@gapp.nthu.edu.tw> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260613170434.23645-1-ku.loong@gapp.nthu.edu.tw
2026-07-03wifi: rtw89: use str_enable_disable() helperPanagiotis Petrakopoulos
Replace "enable"/"disable" strings in ternary expressions with the str_enable_disable() helper from <linux/string_choices.h>. This covers the rfkill state log in rtw89_core_rfkill_poll() and the DPK on/off log in _dpk_onoff(). No functional change intended. Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260612223012.504886-1-npetrakopoulos2003@gmail.com
2026-07-03wifi: rtw89: fw: correct preload field of w2 in ↵Wentao Guan
rtw89_fw_h2c_default_cmac_tbl_be() BE_CCTL_INFO_W2_PRELOAD_ENABLE is for h2c->w2, not h2c->w1. These will cause h2c->w1 wrong overlap by w2 and w2 not initialized. Fixes: c73607b3a8ef ("wifi: rtw89: fw: add CMAC H2C command to initialize default value for RTL8922D") Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260611082021.46650-1-guanwentao@uniontech.com
2026-07-03wifi: rtw88: 8822b: Don't process RF path C in query_phy_status_page1Bitterblue Smith
Replace <= with < in the loop in query_phy_status_page1(). It was processing data related to RF path C, which this chip doesn't have. The only bad effect seems to be that the phy_info file in debugfs was printing unexpected values for RF path C. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/9c4beb36-2954-4db0-844a-74ba5eacf21b@gmail.com
2026-07-03wifi: rtw88: 8822c: Don't process RF path C in query_phy_status_page{0,1}Bitterblue Smith
Replace <= with < in the loops in query_phy_status_page{0,1}(). They were processing data related to RF path C, which this chip doesn't have. The only bad effect seems to be that the phy_info file in debugfs was printing unexpected values for RF path C. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/ee30b95f-bc68-4711-9b15-cf5fd23c3c48@gmail.com
2026-07-03wifi: rtlwifi: rtl8723be: Remove unnecessary irq save/restore in hw_init()William Hansen-Baird
rtl8723be hw_init() calls local_save_flags(flags) followed by local_irq_enable(). Later, local_irq_restore(flags) is called. This causes warnings from Lockdep on boot and modprobe, as local_irq_restore(flags) should only be called while irqs are disabled. The warning was introduced to detect this class of bug in [1]. With testing I found that all paths which call hw_init() have irqs already enabled for rtl8723be. Furthermore, the calls were originally added for the rtl8192ce in commit f78bccd79ba3 ("rtlwifi: rtl8192ce: Fix too long disable of IRQs") before later being added to most other rtlwifi drivers. Commit d3feae41a347 ("rtlwifi: Update power-save routines for 062814 driver") then replaces the call to spin_lock_irqsave() before hw_init(), and thus the codepath which caused irqs to be disabled in hw_init and prompted the original commit has been removed. The same irq save/restore pattern is also present in the hw_init() of rtl8192ce, rtl8723ae, rtl8188ee, rtl8192se and rtl8192cu, however I don't have the hardware to test them, so I did not include them in my changes. Tested on a Razer Blade 14 2017. Example of output from Lockdep prior to fix: raw_local_irq_restore() called with IRQs enabled ... Call Trace: <TASK> rtl8723be_hw_init+0x5992/0x7220 [rtl8723be] ? static_obj+0x61/0xa0 rtl_pci_start+0x222/0x5c0 [rtl_pci] rtl_op_start+0x128/0x1a0 [rtlwifi] ? __kasan_check_read+0x11/0x20 drv_start+0x16c/0x550 [mac80211] ... irq event stamp: 887679 hardirqs last enabled at (887689): [<ffffffff96511170>] __up_console_sem+0x90/0xa0 hardirqs last disabled at (887698): [<ffffffff96511155>] __up_console_sem+0x75/0xa0 softirqs last enabled at (887670): [<ffffffff962f4675>] __irq_exit_rcu+0x175/0x2f0 softirqs last disabled at (887649): [<ffffffff962f4675>] __irq_exit_rcu+0x175/0x2f0 ---[ end trace 0000000000000000 ]--- [1] https://lore.kernel.org/all/20210111153707.10071-1-mark.rutland@arm.com/ Signed-off-by: William Hansen-Baird <william.hansen.baird@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260609095359.2964193-1-william.hansen.baird@gmail.com
2026-07-03wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()Dan Carpenter
This > comparison should be >= to avoid an out of bounds access. Fixes: 419ed7f4a053 ("wifi: rtw89: debug: extend bb_info with TX status and PER") Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/aia25i0ds3B6QF6c@stanley.mountain
2026-07-03wifi: rtw89: fw: support scan offload v2 for WiFi 7 chipsPing-Ke Shih
The format of scan offload v2 is to extend fields to consider channel noise as a factor to adjust dwell time of certain channels. Leave empty for now to ignore this factor. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260525070735.27659-3-pkshih@realtek.com
2026-07-03wifi: rtw89: fw: add first set of firmware features by version for RTL8922DPing-Ke Shih
The firmware features including version of command/event format are maintained by this table, which enables features by firmware version. Define the first feature set accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260525070735.27659-2-pkshih@realtek.com
2026-07-03gpu: nova-core: remove local bitfield macroAlexandre Courbot
This module is now orphaned code, superseded by a kernel-global implementation, so remove it. Reviewed-by: Eliot Courtney <ecourtney@nvidia.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260701-nova-bitfield-v2-2-2e949bf1836c@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-03gpu: nova-core: convert to kernel bitfield macroAlexandre Courbot
Replace uses of the Nova-local `bitfield!` macro with the kernel one. Reviewed-by: Eliot Courtney <ecourtney@nvidia.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260701-nova-bitfield-v2-1-2e949bf1836c@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-02Merge tag 'vfio-v7.2-rc2' of https://github.com/awilliam/linux-vfioLinus Torvalds
Pull VFIO fixes from Alex Williamson: "Mostly straightforward fixes here, inconsistent runtime PM handling due to global device policies, bitfield races, unwind path gaps, teardown ordering, and a misplaced library flag. - Fix racy bitfield updates in vfio-pci-core and the mlx5 vfio-pci variant driver with a binary split between setup/release and runtime modified flags. These were noted across several Sashiko reviews as pre-existing issues (Alex Williamson) - Fix runtime PM inconsistency where the vfio-pci driver module_init could modify the idle PM policy of existing devices through globals managed in vfio-pci-core, leading to unbalanced runtime PM operations (Alex Williamson) - Restore mutability of writable vfio-pci module options by further pulling policy globals out of vfio-pci-core, to instead be latched per device at device init. Provide visibility of the per device latched values through debugfs (Alex Williamson) - Fix missing VGA arbiter uninit callback in unwind path (Alex Williamson) - Reorder device debugfs removal before device_del() to avoid gap where debugfs is available with stale devres pointers (Alex Williamson) - Move UUID library linking flag from vfio selftest Makefile into libvfio.mk to avoid exposing such dependencies when linking with KVM selftests (Sean Christopherson)" * tag 'vfio-v7.2-rc2' of https://github.com/awilliam/linux-vfio: vfio: selftests: Add luuid to libvfio.mk's list of libraries, not to the Makefile vfio/pci: Expose latched module parameter policy in debugfs vfio: Remove device debugfs before releasing devres vfio/pci: Latch all module parameters per device vfio/mlx5: Fix racy bitfields and tighten struct layout vfio/pci: Fix racy bitfields and tighten struct layout vfio/pci: Release the VGA arbiter client on register_device() failure vfio/pci: Latch disable_idle_d3 per device
2026-07-03iio: adc: ti-adc081c: use dev_err_probe() for probe time errorPrashant Rahul
This simplifies error handling and ensures consistent error reporting. Signed-off-by: Prashant Rahul <prashantrahul23@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-02nilfs2: reject invalid block index in GC ioctlRyusuke Konishi
Syzbot reported list corruption caused by a double list_add_tail() call on bh->b_assoc_buffers within nilfs_lookup_dirty_data_buffers(). Analysis revealed that the root cause was the insertion of a page/folio with a page index of ULONG_MAX into the page cache via the GC ioctl. filemap_get_folios_tag(), called by nilfs_lookup_dirty_data_buffers(), repeatedly detects a dirty folio with a page index of ULONG_MAX due to index wrap-around, leading to duplicate processing of dirty buffers. As a preparatory step, the GC ioctl loads the page/folio of the block to be moved during GC and inserts it into the page cache based on information in the nilfs_vdesc structure passed as an argument. Normally, this does not cause issues because the user-space GC library configures the nilfs_vdesc structure properly. However, since there is no range check on the parameters determining the page index, a request with artificially crafted parameters -- such as those generated by Syzbot -- can result in a page/folio being inserted with a page index of ULONG_MAX, triggering the above problem. This resolves the issue by checking the ranges of 'vd_offset' and 'vd_vblocknr' in the nilfs_vdesc structure that determine the page index, thereby preventing the invalid page/folio insertions. Reported-by: syzbot+c37bed40868932d790e9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c37bed40868932d790e9 Fixes: 7942b919f732 ("nilfs2: ioctl operations") Cc: wuyankun <wuyankun@uniontech.com> Cc: stable@vger.kernel.org Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-07-03Merge tag 'drm-misc-fixes-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v7.2-rc2: - Fix potential null pointer dereference in dma-buf. - Handle 0 in dma_fence_dedup_array. - Use the correct callback in dma_fence_timeline_name. - Fix device removal handling in amdxdna. - kernel-doc fixes. - Include header fix for drm_ras.h - Handle edids better in virtio. - Use the clk_bulk api for error handling in malidp. - More clk handling fixes for komeda. - panthor scheduler block fallout fixes. - panthor unplug fixes. - other panthor fixes. - Fix unnecessary WARN_ON in topology probe after teardown. - Add refcount to amdxdna job to fix use-after free. - Fix increasing args->size in ioctl's of drm/imagination. - Handle stride correctly in pvr_set_uobj_array. - Only call imagination's drm_sched_entity_fini once. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/786bdc92-0ce3-4c0f-9668-b0fa8a0047ea@linux.intel.com
2026-07-03Merge tag 'drm-xe-fixes-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Wedge from the timeout handler only after releasing the queue (Rodrigo) - Fix a NULL pointer dereference (Francois) - Remove redundant exec_queue_suspended (Lu) - RTP / OA whitelist fixes (Ashutosh, Gustavo, Thomas) - Return error on non-migratable faults requiring devmem (Matt Brost) - Skip FORCE_WC and vm_bound check for external dma-bufs (Matt Auld) - Hold notifier lock for write on inject test path (Shuicheng) - Drop bogus static from finish in force_invalidate (Shuicheng) - Fix double-free of managed BO in error path (Shuicheng) - Don't attempt to process FAST_REQ or EVENT relays (Michal) - Fix NPD in bo_meminfo (Matthew Auld) - Prevent invalid cursor access for purged BOs (Matthew Auld) - Fix offset alignment for MERT WHITELST_OA_MERT_MMIO_TRG (Ashutosh) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/akZ_UbrL94G4F2iA@fedora
2026-07-03selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable checkHisam Mehboob
Building the rseq selftests against musl libc fails because musl's <features.h> does not provide the glibc-specific __GNUC_PREREQ macro: error: missing binary operator before token '(' Replace __GNUC_PREREQ(11, 1) with an equivalent check using __GNUC__ and __GNUC_MINOR__ directly. This pattern is portable across all C library implementations and is already used elsewhere in the tools/ tree (e.g., tools/include/linux/string.h). This also allows removing the #include <features.h>, which was only needed for __GNUC_PREREQ. Fixes: 886ddfba933f ("selftests/rseq: Introduce thread pointer getters") Signed-off-by: Hisam Mehboob <hisamshar@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260618193724.589113-2-hisamshar@gmail.com
2026-07-03Merge tag 'amd-drm-fixes-7.2-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.2-2026-07-02: amdgpu: - Soc24 aborted suspend fix - Drop unecessary BUG() and BUG_ON() from error paths - SCPM fix - Power reporting fix - DCE HDR fix - UVD boundary checks - VCN boundary checks - VCE boundary checks - DCN 4.2 fixes - Large stack allocation fixes - Fix aperture mapping leak - UserQ fixes - Ignore_damage_clips fix - ACP fixes - DC boundary checks - GPUVM fixes - JPEG idle check fixes - Userptr fix - GC 11.7 updates - Non-4K page fix - SMU 13 fixes - DP alt mode fix amdkfd: - Boundary checks - CRIU fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260702143138.68463-1-alexander.deucher@amd.com
2026-07-03Merge tag 'drm-intel-fixes-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Input validation fixes for BIOS and EDID (Jani) - Fix HDCP code buffer overflow and seq_num_v monotonic increase check (Jani) - Fix near-NULL deref in i915_active during GFP_ATOMIC exhaustion (Joonas) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patch.msgid.link/akYLxDea3kEyHqJA@jlahtine-mobl
2026-07-02drm/xe: Add tile_count to xe_probed_infoGustavo Sousa
On multi-tile platforms, we need to probe the hardware for the number of tiles that are present in the platform. That means that we should do that as part of xe_probe_info() instead of xe_info_init(). Do that. Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-9-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02drm/xe: Don't initialize tile_count in xe_info_init_early()Gustavo Sousa
The value of xe->info.tile_count is only really valid after xe_info_probe_tile_count(). Any use of tile_count before that point is invalid and, consequently, initializing it in xe_info_init_early() is pointless. Move the initialization to xe_info_probe_tile_count(). Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-8-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02drm/xe: Add graphics/media IPs and their step info to xe_probed_infoGustavo Sousa
On GMDID-based platforms, the driver needs to probe the hardware by reading GMDID registers in order to identify the graphics/media/display IPs that are present in the platform as well as their stepping values. Currently, xe_info_init() has such a probing logic, but that task should be rather responsibility of xe_probe_info(). As such, move it to the latter. For pre-GMDID platforms, the IPs are identified via PCI devid and revid fields, which is arguably also hardware dependent. So do the same for those platforms. Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-7-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02drm/xe/tests: Set non-GMDID graphics step in xe_pci_fake_device_init()Gustavo Sousa
Currently the logic to set the graphics step for non-GMDID-based platforms in kunit testing is defined in xe_wa_test_init(). That logic should rather belong to the helper xe_pci_fake_device_init(), so move it there. Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-6-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02drm/xe: Add platform-level step info to xe_probed_infoGustavo Sousa
The platform-level step information depends on the PCI revid and, as such, should be probed in xe_probe_info_early() instead of xe_info_init_early(). Move the code accordingly. Note that we currently only update probed_info->step.platform as part of this change. We will deal with the other fields of probed_info->step as a follow-up change, which will be tied to the probing of graphics and media IPs. Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-5-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02drm/xe/step: Make xe_step_platform_get() independent from xe->infoGustavo Sousa
Currently xe_step_platform_get() uses info fields from xe->info to define the platform-level stepping value. Because the platform-level stepping info depends on the PCI revid, it should be defined as part of xe_probe_info_early() instead of being directly probed inside xe_info_init_early(). Let's make sure that xe_step_platform_get() receives the necessary data as parameters and does not depend on xe->info. That will allow us to move the call up to xe_probe_info_early() in an upcoming change. Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-4-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02drm/xe: Add devid and revid to xe_probed_infoGustavo Sousa
The PCI devid and revid fields are info that we probe from the hardware (indirectly via the PCI subsystem). Add them to xe_probed_info and set them via xe_probe_info_early(), since the respective fields in xe->info are updated in xe_info_init_early(). Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-3-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02drm/xe/step: Pass xe_step_info to xe_step_*_get() functionsGustavo Sousa
The xe_step_*_get() functions update the step directly in xe->info.step and are called by functions xe_info_init_early() and xe_info_init(). As the stepping info is something probed from the hardware (via PCI revid and/or GMDID) and we want to move away from probing inside xe_info_init*() functions, let's make xe_step_*_get() functions modify a pointer to the step structure instead of modifying xe->info.step directly: this will allow an upcoming change that will move those function calls out of the info init functions and will pass a member of struct xe_probed_info instead of xe->info.step. Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-2-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02drm/xe: Add framework for info probingGustavo Sousa
Functions xe_info_init_early() and xe_info_init() currently probe some information from the hardware while doing initialization of info fields. Besides mixing responsibilities, another issue from this approach is that kunit tests need to implement static stubs for the probing part. Let's prepare the ground to ensuring that those functions stop probing the information from the hardware by creating the necessary framework for extracting the probing bits out of them. Do that by creating a new struct type called xe_probed_info and the functions responsible for populating it. In upcoming changes, we will gradually refactor the code so that all info needed by xe_info_init_early() and xe_info_init() that is probed from the hardware is passed to them via struct xe_probed_info. Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Reviewed-by: Violet Monti <violet.monti@intel.com> Link: https://patch.msgid.link/20260609-xe-probe-info-v1-1-21e83e188e60@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-07-02csky: Fix a4/a5 restoration in syscall trace pathHanlin Song
The syscall trace path reloads syscall arguments from pt_regs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments before invoking syscallid. The current code adjusts sp before loading LSAVE_A4 and LSAVE_A5. Since those offsets are relative to the original pt_regs base, loading them after changing sp fetches the wrong slots. As a result, traced syscalls that use the 5th or 6th argument may receive corrupted arguments. This is visible with mmap2(), which takes six arguments. A small PTRACE_SYSCALL reproducer opens a file and maps one page with: mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0) Before the fix, the traced child fails the mmap and exits with 12. After the fix, the mapping succeeds and the child exits with 0. Fix the trace path by loading a4/a5 from pt_regs before changing sp. Tested on: ck860f, linux-4.19.15, C-SKY abiv2 Fixes: e0bbb53843b5 ("csky: Fixup abiv2 syscall_trace break a4 & a5") Suggested-by: Guo Ren <guoren@kernel.org> Signed-off-by: Hanlin Song <pgeorge8929@gmail.com> Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
2026-07-02wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_beginGaole Zhang
In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference. Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P) ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k] ath11k_core_restart+0x40/0x168 [ath11k] Fix this by: - skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set - setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds - setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling on error Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1 Fixes: 6fe62a8cec51c ("wifi: ath11k: Add cold boot calibration support on WCN6750") Signed-off-by: Gaole Zhang <gaole.zhang@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260609090609.4041009-1-gaole.zhang@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-18 05:01:28 +0000