summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-05-04staging: rtl8723bs: os_dep: simplify boolean comparisonsAndrei Khomenkov
Simplify boolean comparisons to improve readability and conform to the Linux kernel coding style. Signed-off-by: Andrei Khomenkov <khomenkov@mailbox.org> Link: https://patch.msgid.link/20260427175846.23470-4-khomenkov@mailbox.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: hal: simplify boolean comparisonsAndrei Khomenkov
Simplify boolean comparisons to improve readability and conform to the Linux kernel coding style. Signed-off-by: Andrei Khomenkov <khomenkov@mailbox.org> Link: https://patch.msgid.link/20260427175846.23470-3-khomenkov@mailbox.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: core: simplify boolean comparisonsAndrei Khomenkov
Simplify boolean comparisons to improve readability and conform to the Linux kernel coding style. Signed-off-by: Andrei Khomenkov <khomenkov@mailbox.org> Link: https://patch.msgid.link/20260427175846.23470-2-khomenkov@mailbox.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: fix block comment alignment in hal_pwr_seq.cFrancisco Maestre
Fix the multi-line block comment at the top of the file to follow the kernel coding style: each continuation line should start with ' * ' and the closing '*/' should be on its own line without a preceding blank line. This fixes the following checkpatch.pl warning: WARNING: Block comments should align the * on each line Signed-off-by: Francisco Maestre <francisco@maestretorreblanca.com> Link: https://patch.msgid.link/20260503005802.69046-1-francisco@maestretorreblanca.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: drop blank line before close brace in rtw_ieee80211.cStepan Ionichev
Drop a blank line before a close brace in rtw_get_wapi_ie(), flagged by checkpatch.pl: CHECK: Blank lines aren't necessary before a close brace '}' No functional change. Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com> Link: https://patch.msgid.link/20260502085018.1440-1-sozdayvek@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: remove unnecessary blank lines in rtw_ioctl_set.cStepan Ionichev
Drop blank lines flagged by checkpatch.pl in rtw_ioctl_set.c: CHECK: Blank lines aren't necessary before a close brace '}' CHECK: Blank lines aren't necessary after an open brace '{' No functional change. Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Reviewed-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260502084930.857-1-sozdayvek@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: rename DisableInterrupt8723BSdio() to snake_caseNikolay Kulikov
Rename function DisableInterrupt8723BSdio() to rtw_sdio_disable_interrupt() and format its description to comply with Linux kernel coding style. Declare this function without 'extern' prototype in the .h file to fix checkpatch.pl warning. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260430172954.12828-3-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: remove wrapper rtw_hal_disable_interrupt()Nikolay Kulikov
Remove unnecessary wrapper and call DisableInterrupt8723BSdio() function directly to simplify the code. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260430172954.12828-2-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: simplify NULL pointer comparisons in rtw_recv.hAbhai Kollara
Fix checkpatch.pl warnings regarding explicit comparisons to NULL. The kernel coding style prefers the shorter if (!ptr) idiom over if (ptr == NULL). Clean up the inline functions in rtw_recv.h to match this standard. Signed-off-by: Abhai Kollara <abhai@protonmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260430201158.2807823-1-abhai@protonmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: fbtft: remove unused function fbtft_write_gpio16_wr_latchedHungyu Lin
The function fbtft_write_gpio16_wr_latched is not referenced anywhere in the driver and only contains a stub implementation. Remove it from the driver. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Link: https://patch.msgid.link/20260430102529.25019-1-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: rename rtw_btcoex_LPS_Leave to rtw_btcoex_lps_leaveLinus Probert
Renames rtw_btcoex_LPS_Leave to rtw_btcoex_lps_leave in order to conform to kernel code style. Found using checkpatch.pl. Signed-off-by: Linus Probert <linus.probert@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427173857.585742-9-linus.probert@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: rtw_btcoex_LPS_Enter() -> rtw_btcoex_lps_enter()Linus Probert
Renames rtw_btcoex_LPS_Enter to rtw_btcoex_lps_enter in order to conform to kernel code style. Found using checkpatch.pl. Signed-off-by: Linus Probert <linus.probert@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427173857.585742-8-linus.probert@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: rename rtw_btcoex_RejectApAggregatedPacket()Linus Probert
Renames rtw_btcoex_RejectApAggregatedPacket to rtw_btcoex_reject_ap_aggregated_packet in order to conform to kernel code style. Found using checkpatch.pl. Signed-off-by: Linus Probert <linus.probert@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427173857.585742-7-linus.probert@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: rtw_btcoex_HaltNotify() -> rtw_btcoex_halt_notify()Linus Probert
Renames function rtw_btcoex_HaltNotify to rtw_btcoex_halt_notify in order to conform to kernel code style. Found using checkpatch.pl. Signed-off-by: Linus Probert <linus.probert@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427173857.585742-6-linus.probert@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: rename rtw_btcoex_media_status_notify definition argLinus Probert
Renames rtw_btcoex_media_status_notify_definition argument mediaStatus to media_status in order to conform to kernel code style. This was found using checkpatch.pl Signed-off-by: Linus Probert <linus.probert@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427173857.585742-5-linus.probert@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: rename rtw_btcoex_MediaStatusNotify()Linus Probert
Renames function rtw_btcoex_MediaStatusNotify to rtw_btcoex_media_status_notify which removes CamelCase in order to conform to kernel code style. Issue found using checkpatch.pl Signed-off-by: Linus Probert <linus.probert@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427173857.585742-4-linus.probert@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: add function definition arg names to rtw_btcoex.hLinus Probert
Adds function definition argument names to rtw_btcoex.h in order to conform to kernel code style. This eliminates warnings generated by checkpatch.pl. In all cases it's the 'struct adapter *' argument which has been given the name 'padapter'. This matches the names used in the implementations of these functions. Signed-off-by: Linus Probert <linus.probert@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427173857.585742-3-linus.probert@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: remove blank line in rtw_btcoex.hLinus Probert
Removes redundant blank line in rtw_btcoex.h. Found using checkpatch.pl. Signed-off-by: Linus Probert <linus.probert@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427173857.585742-2-linus.probert@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: fix typo in rtw_pwrctrl.cMaha Maryam Javaid
Fix spelling mistake: willl -> will Signed-off-by: Maha Maryam Javaid <mahamaryamjavaid@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260429034156.11523-1-mahamaryamjavaid@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: replace NULL comparison with NOT operatorMiguel Cyrineu Vale
Fix checkpatch error "Comparison to NULL could be written "!psta"" in ioctl_cfg80211.c:2432 Signed-off-by: Miguel Cyrineu Vale <miguelcvalealt@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260427193759.71642-1-miguelcvalealt@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04drm/bridge: tda998x: Use __be32 for audio port OF property pointerKory Maincent (TI)
of_get_property() returns a pointer to big-endian (__be32) data, but port_data in tda998x_get_audio_ports() was declared as const u32 *, causing a sparse endianness type mismatch warning. Fix the declaration to use const __be32 *. Fixes: 7e567624dc5a4 ("drm/i2c: tda998x: Register ASoC hdmi-codec and add audio DT binding") Cc: stable@vger.kernel.org Signed-off-by: Kory Maincent (TI) <kory.maincent@bootlin.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260428090457.121894-1-kory.maincent@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-05-04dma-buf/dma_fence_array: remove unused functionality v4Christian König
Amdgpu was the only user of the signal on any feature and we dropped that use case recently, so we can remove that functionality. v2: update num_pending only after the fence is signaled v3: separate out simplifying dma_fence_array implementation v4: fix XE patch split fallout Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Link: https://lore.kernel.org/r/20260422103012.1647-1-christian.koenig@amd.com
2026-05-04staging: octeon: convert cvmx_pip_port_status_t from typedef to plain structEric Wu
The Linux kernel coding style discourages the use of typedefs for structs. Convert cvmx_pip_port_status_t to a plain 'struct cvmx_pip_port_status' and update all users across the MIPS Octeon architecture code and the staging driver. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-8-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_pko_port_status_t from typedef to plain structEric Wu
The Linux kernel coding style discourages the use of typedefs for structs. Convert cvmx_pko_port_status_t to a plain 'struct cvmx_pko_port_status' and update all users across the MIPS Octeon architecture code and the staging driver. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-7-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_pko_status_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_pko_status_t to a plain 'enum cvmx_pko_status' and update all users across the MIPS Octeon architecture code and the staging driver stubs. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-6-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_pko_lock_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_pko_lock_t to a plain 'enum cvmx_pko_lock' and update all users across the MIPS Octeon architecture code and the staging driver stubs. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-5-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_pow_wait_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_pow_wait_t to a plain 'enum cvmx_pow_wait' and update all users across the MIPS Octeon architecture code and the staging driver stubs. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-4-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_helper_interface_mode_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_helper_interface_mode_t to a plain 'enum cvmx_helper_interface_mode' and update all users across the MIPS Octeon architecture code and the staging driver stubs. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-3-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_spi_mode_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_spi_mode_t to a plain 'enum cvmx_spi_mode' and update all users across the MIPS Octeon architecture code and the staging driver stubs. This is part of a series converting all remaining enum typedefs in the octeon subsystem to plain enums, improving compliance with the kernel coding style. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-2-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: most: dim2: remove filename from comment blocksShyam Sunder Reddy Padira
Remove redundant filename references from top-of-file comment blocks across dim2 source files to resolve checkpatch.pl warnings. The filename is already implied by the file path and including it in comments can become outdated. No functional changes. Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com> Link: https://patch.msgid.link/20260503104447.64657-1-shyamsunderreddypadira@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: greybus: fix typo in sysfs-bus-greybusMaha Maryam Javaid
Fix spelling mistake: attibute -> attribute Signed-off-by: Maha Maryam Javaid <mahamaryamjavaid@gmail.com> Link: https://patch.msgid.link/20260429033816.11282-1-mahamaryamjavaid@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: sm750fb: remove double space in fb_ops entriesAhmet Sezgin Duran
Remove extra space after '=' in .fb_check_var assignments. Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net> Link: https://patch.msgid.link/20260428204416.55374-1-ahmet@sezginduran.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: most: video: remove filename from the top-of-file commentShyam Sunder Reddy Padira
Remove the filename reference from top-of-file comment, to resolve checkpatch.pl warning. The filename can become outdated if the file is renamed. No functional change. Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com> Link: https://patch.msgid.link/20260427175636.4605-1-shyamsunderreddypadira@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: nvec: fix unconditional pm_power_off teardownAlexandru Hossu
tegra_nvec_remove() unconditionally sets pm_power_off = NULL, even if nvec was not the one that registered it. This breaks any other driver that may have set pm_power_off to its own handler. Replace the unconditional assignment with a guarded check so that pm_power_off is only cleared if nvec was the one that set it. Also remove the stale FIXME comment, as the guard addresses exactly what it was asking for. Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com> Link: https://patch.msgid.link/20260427081713.3401874-3-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: nvec: fix use-after-free in nvec_rx_completed()Alexandru Hossu
In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check. Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses") Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com> Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: sm750fb: fix typo in commentHungyu Lin
Fix typo in a comment. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Link: https://patch.msgid.link/20260427060420.1076-1-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: sm750fb: propagate error codes from de_wait()Hungyu Lin
The sm750 acceleration functions currently return -1 when de_wait() fails, discarding the original error code. Since de_wait() now returns proper errno values, propagate the error code instead of returning -1. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Link: https://patch.msgid.link/20260427054657.758-3-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: sm750fb: return -ETIMEDOUT on timeout in de_wait functionsHungyu Lin
The hw_sm750le_de_wait() and hw_sm750_de_wait() functions return -1 when a timeout occurs. Replace these with -ETIMEDOUT to use a proper errno value and better describe the error condition. All callers check the return value as non-zero, so this change does not alter existing behavior. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Link: https://patch.msgid.link/20260427054657.758-2-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: reduce nesting in rtw_security.cMaksym Pikhotskyi
Improve readability of functions: rtw_tkip_encrypt, rtw_tkip_decrypt, rtw_aes_encrypt in rtw_security.c by adding early returns for the encryption type check and the stainfo null check. Signed-off-by: Maksym Pikhotskyi <mpikhotskyi@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260417095452.23440-2-mpikhotskyi@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: fix stainfo check in rtw_aes_decryptMaksym Pikhotskyi
The null-pointer-guard was incorrect, returning _FAIL on valid pointer. Invert the guard, so it returns _FAIL on invalid pointer. Fixes: e23ad1570028 ("staging: rtl8723bs: use guard clause for stainfo check") Reported-by: Luka Gejak <luka.gejak@linux.dev> Closes: https://lore.kernel.org/linux-staging/E4BF62EF-C6F6-431F-8EDC-77C1E613E66B@linux.dev/ Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Maksym Pikhotskyi <mpikhotskyi@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260417095452.23440-1-mpikhotskyi@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04wifi: ath5k: do not access array OOBJiri Slaby (SUSE)
Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > <TASK> > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus. Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES). Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reported-by: Vincent Danjean <vdanjean@debian.org> Link: https://lore.kernel.org/all/aQYUkIaT87ccDCin@eldamar.lan Closes: https://bugs.debian.org/1119093 Fixes: 6d7b97b23e11 ("ath5k: fix tx status reporting issues") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251209100459.2253198-1-jirislaby@kernel.org Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04wifi: ath12k: fix peer_id usage in normal RX pathBaochen Qiang
ath12k_dp_rx_deliver_msdu() currently uses hal_rx_desc_data::peer_id parsed from mpdu_start descriptor to do peer lookup. However In an A-MSDU aggregation scenario, hardware only populates mpdu_start descriptor for the first sub-msdu, but not the following ones. In that case peer_id could be invalid, leading to peer lookup failure: ath12k_wifi7_pci 0000:06:00.0: rx skb 00000000c391c041 len 1532 peer (null) 0 ucast sn 0 eht320 rate_idx 12 vht_nss 2 freq 6105 band 3 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0 As a result pubsta is NULL and parts of ieee80211_rx_status structure are left uninitialized, which may cause unexpected behavior. Fix it by switching the normal RX path to use ath12k_skb_rxcb::peer_id which is parsed from REO ring's rx_mpdu_desc and is always valid. hal_rx_desc_data::peer_id is still used in ath12k_wifi7_dp_rx_frag_h_mpdu(), which is safe since A-MSDU aggregation does not occur for fragmented frames. Similarly, ath12k_skb_rxcb::peer_id may be overwritten by hal_rx_desc_data::peer_id in ath12k_wifi7_dp_rx_h_mpdu(), which only handles non-aggregated multicast/broadcast traffic. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 11157e0910fd ("wifi: ath12k: Use ath12k_dp_peer in per packet Tx & Rx paths") Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260427-ath12k-fix-peer-id-source-v1-1-b5f701fb8e88@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04wifi: ath12k: initialize RSSI dBm conversion event stateRameshkumar Sundaram
Currently, the RSSI dBm conversion event handler leaves struct ath12k_wmi_rssi_dbm_conv_info_arg uninitialized on the stack before calling the TLV parser. If one of the optional sub-TLVs is absent, the corresponding *_present flag retains stack garbage and later gets read in ath12k_wmi_update_rssi_offsets(). With UBSAN enabled this triggers an invalid-load report for _Bool: UBSAN: invalid-load in drivers/net/wireless/ath/ath12k/wmi.c:9682:15 load of value 9 is not a valid value for type '_Bool' Call Trace: ath12k_wmi_rssi_dbm_conversion_params_info_event.cold+0x72/0x85 [ath12k] ath12k_wmi_op_rx+0x1871/0x2ab0 [ath12k] ath12k_htc_rx_completion_handler+0x44b/0x810 [ath12k] ath12k_ce_recv_process_cb+0x554/0x9f0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] Initialize the parsed event state to zero before passing it to the TLV parser so missing sub-TLVs correctly leave the presence flags false. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: 0314ee81a91d ("wifi: ath12k: handle WMI event for real noise floor calculation") Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260427103011.2983269-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04wifi: ath12k: fix leak in some ath12k_wmi_xxx() functionsNicolas Escande
Some wmi functions were using plain 'return ath12k_wmi_cmd_send(...)' without explicitly handling the error code. This leads to leaking the skb in case of error. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00218-QCAHKSWPL_SILICONZ-1 Fixes: 66a9448b1b89 ("wifi: ath12k: implement hardware data filter") Fixes: 593174170919 ("wifi: ath12k: implement WoW enable and wakeup commands") Fixes: 4a3c212eee0e ("wifi: ath12k: add basic WoW functionalities") Fixes: 16f474d6d49d ("wifi: ath12k: add WoW net-detect functionality") Fixes: 1666108c74c4 ("wifi: ath12k: support ARP and NS offload") Fixes: aab4ae566fa1 ("wifi: ath12k: support GTK rekey offload") Fixes: 7af01e569529 ("wifi: ath12k: handle keepalive during WoWLAN suspend and resume") Signed-off-by: Nicolas Escande <nico.escande@gmail.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20260422163258.3013872-1-nico.escande@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04mtd: sm_ftl: allocate cis_buffer with main structRosen Penev
Use a flexible array member and kzalloc_flex() to do so. Simplifies memory allocation slightly. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04mtd: spinand: Prevent continuous reads on some controllersMiquel Raynal
Some controllers do not have full control over the CS line state and may deassert it under certain conditions in the middle of a (long) transfer. Continuous reads are stopped with a CS deassert, hence both features cannot live together. Whenever a controller flags that it cannot maintain the CS state reliably, disable continuous reads entirely. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04mtd: spinand: Make sure continuous read is always disabled during probeMiquel Raynal
Recent changes made sure whenever we were using continuous reads, we would first start by disabling the feature to ensure a well proven and stable probe sequence. For development purposes, it might also matter to make sure we always disable continuous reads at first, in case the ECC configuration would change. Doing this "automatically" will become even more relevant when we add extra controller flags to prevent continuous reads at all. Ensure we disable continuous reads if the feature is available on the chip, regardless of whether it will be used or not. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04drm/bridge: replace use of system_wq with system_percpu_wqMarco Crivellari
Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20251104111339.128685-1-marco.crivellari@suse.com
2026-05-04mtd: spinand: winbond: Add support for continuous reads on W25NxxJWMiquel Raynal
As for the W35NxxJW family, add support for W25N{01,02}JW continuous read support. Similar operations require to be done, such as setting a specific bit in a configuration register, and providing a set of read variants without the address cycles. As read from cache variants are badly supported by SPI memory controllers, we create a new set of read from cache templates with a fake address cycle and just enough dummy cycles. There are two unsupported configurations (which would require 4.5 dummy bytes), so we just do not provide them. The same extra value in the ECC is possible as with the W35NxxJW family, so we reference the same helper to retrieve the ECC status. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> --- All variants have been validated on a Nuvoton MA35D1 platform.
2026-05-04mtd: spinand: winbond: Create a helper to detect the need for the HS bitMiquel Raynal
The logic is not complex but might be reused to cleanup a bit the section by moving it to a dedicated helper. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>