Comments in the rtl8723bs driver contain references to
CONFIG_IOCTL_CFG80211, which does not exist in the kernel. Remove these
references.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260613231514.145336-1-enelsonmoore@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
A comment in the rtl8723bs driver contains a reference to
CONFIG_SDIO_HCI, which does not exist in the kernel. Remove it.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260613183055.10425-1-enelsonmoore@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CHAN_FMT and CHAN_ARG are defined but never used anywhere in
the driver. Most of their content is commented-out dead code.
Remove them.
This also fixes a checkpatch error:
ERROR: Macros with complex values should be enclosed in parentheses
Signed-off-by: Chen-Yu Yeh <chenyou910331@gmail.com>
Link: https://patch.msgid.link/20260611081644.1553264-1-chenyou910331@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
NDEV_ARG, FUNC_NDEV_FMT and FUNC_NDEV_ARG are defined but never
used anywhere in the driver. Remove them.
This also fixes a checkpatch error:
ERROR: Macros with complex values should be enclosed in parentheses
Signed-off-by: Chen-Yu Yeh <chenyou910331@gmail.com>
Link: https://patch.msgid.link/20260611074613.1550984-1-chenyou910331@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Comments in the rtl8723bs driver contain many references to
CONFIG_IEEE80211W, which does not exist in the kernel (though it does
exist in wpa_supplicant, where this code was likely also used). Remove
them.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260611014430.437534-1-enelsonmoore@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kmalloc(16, GFP_ATOMIC) in c2h_wk_callback() could in theory return2
NULL, which would then be dereferenced in rtw_hal_c2h_valid().
A 16-byte allocation effectively cannot fail in practice, but add an
else continue; to the guard so the failure path exits the iteration
cleanly to make the code more robust.
Signed-off-by: Nikoloz Bakuradze <nbakuradze28@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/20260610164755.49626-1-nbakuradze28@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The network_type_in_use member of struct wlan_bssid_ex is write-only:
nothing in the driver ever reads it. It is assigned in three places,
none of which feed anything:
- collect_bss_info() hard-codes it to Ndis802_11OFDM24 for every
parsed beacon/probe response, regardless of the network's actual
band or rates (it is even wrong for 5 GHz APs, which the same
function explicitly handles).
- rtw_check_beacon_data() and rtw_update_registrypriv_dev_network()
derive it from the wireless mode via a switch, but the result is
likewise never consumed.
The live PHY classification the driver actually acts on is kept in
wlan_network.network_type (the WIRELESS_11x value), so this NDIS-era
field is redundant.
struct wlan_bssid_ex is an internal structure passed by pointer through
the driver command queue; it is never serialized to firmware or onto
the air (the wire data lives in ies[]), so dropping a member is
layout-safe as long as the module is rebuilt as a whole.
enum ndis_802_11_network_type existed only to type this field, so
remove it as well. No functional change.
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Link: https://patch.msgid.link/20260603122806.1330145-1-congnt264@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The hardware VLAN filter (RFE_CTL_VLAN_FILTER_) drops VLAN-tagged frames
whose VID has not been registered via lan78xx_vlan_rx_add_vid(). It is
left enabled in promiscuous mode, so packet capture (e.g. tcpdump or
Wireshark) does not see tagged frames for unregistered VIDs.
Clear the filter while the interface is promiscuous and restore it from
NETIF_F_HW_VLAN_CTAG_FILTER otherwise. Enforce the same condition in
lan78xx_set_features() so netdev_update_features() cannot re-enable the
filter while promiscuous.
Fixes: 55d7de9de6 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Enrico Pozzobon <enrico.pozzobon@dissecto.com>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20260701-lan78xx-vlan-promisc-v3-1-232266d32743@dissecto.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
After deleting one of the switch-case branches, this parameter became
unused, so remove it.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260601150253.69930-3-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The update_beacon() function is never called with 'ie_id' equal to
'WLAN_EID_VENDOR_SPECIFIC', meaning this case branch will never be
called, so remove it and several related functions.
Removing this case branch also fixes a possible null pointer
dereference in update_bcn_vendor_spec() if 'oui' is NULL, since
its value is not checked in any way.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260601150253.69930-2-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The kselftest build system may recourse back into kbuild when building
test modules. In that case kbuild needs to parse the new flags passed
from the command line, instead of using the ones inherited from the
kbuild invocation.
Force that command line reevaluation.
The same was done for scripts/install.sh in commit 14ccc638b0
("kbuild: cancel sub_make_done for the install target to fix DKMS")
Reported-by: Zelin Deng <zelin.deng@linux.alibaba.com>
Closes: https://lore.kernel.org/all/20260525083721.27857-1-zelin.deng@linux.alibaba.com/
Fixes: c9bb03ac2c ("kbuild: reduce output spam when building out of tree")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Miroslav Benes <mbenes@suse.cz>
Acked-by: Petr Mladek <pmladek@suse.com>
Tested-by: Zelin Deng <zelin.deng@linux.alibaba.com>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Link: https://patch.msgid.link/20260703-makefile-unset-submake-done-v1-1-6899248f3d6a@linutronix.de
Signed-off-by: Petr Mladek <pmladek@suse.com>
The driver defined its own enum ndis_802_11_network_infrastructure to
represent the operating mode (STA/AP/IBSS) and translated nl80211 iftypes
into it in cfg80211_rtw_change_iface(). The kernel already provides
enum nl80211_iftype for this purpose, so use it directly and drop the
redundant translation layer.
Map the removed values as follows:
Ndis802_11IBSS -> NL80211_IFTYPE_ADHOC
Ndis802_11Infrastructure -> NL80211_IFTYPE_STATION
Ndis802_11APMode -> NL80211_IFTYPE_AP
Ndis802_11AutoUnknown -> NL80211_IFTYPE_UNSPECIFIED
Compile-tested only.
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Link: https://patch.msgid.link/20260707104836.3176765-1-congnt264@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
A NULL old_name in a newly loaded livepatch's function entry causes a
NULL pointer dereference in strcmp():
klp_init_patch()
klp_add_nops()
klp_find_func()
strcmp(old_func->old_name, func->old_name)
Add klp_check_patch() at the beginning of klp_enable_patch() to reject
patches with NULL old_name before they reach this code path.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/live-patching/20260529040130.95A9C1F00893@smtp.kernel.org/
Suggested-by: Petr Mladek <pmladek@suse.com>
Suggested-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Miroslav Benes <mbenes@suse.cz>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Tested-by: Petr Mladek <pmladek@suse.com>
Link: https://patch.msgid.link/20260628114635.33572-1-laoar.shao@gmail.com
Signed-off-by: Petr Mladek <pmladek@suse.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmpEQsUACgkQYGjFFmlT
OEpejQ/+OQ0+5tLHUP80eHPJDMx/WBlsGozmWF9LsTIkdZjd9WgVHTbQFMnny85Q
Fnzy1vBpXR7du4tAW+0TiDT7EsFqn1oxm3l5Ccpk2zP35SrPoGaWWSK9Sz6EXkrs
Ky90sJQw8WpggcZ4AnI1uXcsCtgvtMzdX7KHa51uox8g5JWFIAL5tVqCqhPSizlU
oL7iuvWETGLITw8VBu+TDm8fo/ZgrqzW7LE/GEyS+ZaDY3/OV+51DxMDqtNlLeE/
g3V9cGwiLEKhDo5UgVdBHUHcLLMOjJcWA6J90MlQ4Hc+SoIP35JN6lJ4zaXxfoEQ
GtOFRJNFs0m5uD5xDG2RpowPVnDuO73gLNwcxyI8G3uNVnNQKng03U0l34OMwnHv
aZa2FokgjreQ+3gKGKa7YD3d9VKw3TBoQL1bmU53vDMKuNHIedORdEGJgrwk5yLc
+AfFWKsSBUmYn3KdtnJqr8mxFDkzyD754OdIIVSra2fgkugb4pC8k0soEe2FI/9c
Q/ucYyyTUR/v+/9P5ZEV7GeOWzvcvRcuMwesarVsnSIXy40KYlDWjUBZ77t3/K9p
YmFe0/LX0bh1Z1KU0IxIUTWPFT74RCbgAhYK+e0AZ2NQB2loWkg/xsWbXj+ifmH4
iV9dK1qBTpIYoOs+Cd0dABqaR/RSIrbvtS7X0h8zyP22Eh/2xl4=
=PhAT
-----END PGP SIGNATURE-----
Merge tag 'sfc-net-pullrequest-20260630' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl
Lucero Palau, Alejandro says:
====================
pull request: sfc 2026-07-01
here are the last CXL core changes for enabling CXL Type2 drivers to
initialize a CXL-capable device plus the netdev sfc driver changes using
this new CXL core Type2 support.
Please pull or let me know of any problem!
SFC changes for CXL type2 enabling
* tag 'sfc-net-pullrequest-20260630' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:
sfc: support pio mapping based on cxl
sfc: obtain and map cxl range using devm_cxl_probe_mem
sfc: Initialize cxl dpa
sfc: Map cxl regs
sfc: add cxl support
cxl: Support dpa without a mailbox
cxl: Support Type2 cxl regs mapping
====================
Link: https://patch.msgid.link/20260701113805.14072-1-alejandro.lucero-palau@amd.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Correct spaces or mix of tabs+spaces into proper tab-indented lines.
No functional impact (same DTB).
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Harden the check for the constituent memory region page alignment
to prevent over-sharing when the negotiated FFA_PAGE_SIZE size is
smaller than the system PAGE_SIZE.
At the moment we only check that the size of the range is page
aligned, and truncate the address to the page boundary which can
annotate more memory than needed as being used by the FF-A.
Fixes: 4360900017 ("KVM: arm64: Handle FFA_MEM_SHARE calls from the host")
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Sebastian Ene <sebastianene@google.com>
Link: https://patch.msgid.link/20260702103848.1647249-6-sebastianene@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Prevent the pKVM hypervisor from making assumptions that the
endpoint memory access descriptor (EMAD) comes right after the
FF-A memory region header.
Prior to FF-A version 1.1 the header of the memory region
didn't contain an offset to the endpoint memory access descriptor.
The layout of a memory transaction looks like this from 1.1 onward:
Type | Field name | Offset
[ Header | ffa_mem_region | 0
EMAD 1 | ffa_mem_region_attributes) | ffa_mem_region.ep_mem_offset
]
Verify that the offset to the first endpoint memory access descriptor
is within the mailbox buffer bounds.
Also, fix one hardcoded sizeof(struct ffa_mem_region_attributes) that
should be replaced ffa_emad_size_get() for compatibility with FFA v1.0.
Fixes: 42fb33dde4 ("KVM: arm64: Use FF-A 1.1 with pKVM")
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Sebastian Ene <sebastianene@google.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Link: https://patch.msgid.link/20260702103848.1647249-5-sebastianene@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Sashiko (locally) reports out of bound write possiblity if SPMD
returns an invalid data.
While SPMD is considered trusted, pKVM does some basic checks,
for offset to be less than or equal len.
However, that is incorrect as even if the offset is smaller than
len pKVM can still access out of bound memory in the next
ffa_host_unshare_ranges().
Split this check into 2:
1- Check that the fixed portion of the descriptor fits.
2- After getting reg, check the variable array size addr_range_cnt
fits.
Also, drop the WARN_ONs as that will panic the kernel and in the
next checks there are no WARNs, so that makes it consistent.
Fixes: 0a9f15fd56 ("KVM: arm64: pkvm: Add support for fragmented FF-A descriptors")
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Sebastian Ene <sebastianene@google.com>
Link: https://patch.msgid.link/20260702103848.1647249-4-sebastianene@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
This field is set to 'true' once and is never used again. Remove it to
eliminate dead code.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260531080015.74870-1-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove tab characters that appeared after '/*' in two comment lines,
which caused 'please, no space before tabs' warnings. Replace the
space+tab combination with a single space after the comment opener.
Detected by checkpatch.pl with --strict flag.
Signed-off-by: Praveen Jayaprakash Pattar <praveen.pattar2022@gmail.com>
Link: https://patch.msgid.link/20260531045511.5774-1-praveen.pattar2022@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix incorrect indentation of an if statement inside an else block.
The statement had a space before it instead of proper tab alignment,
causing checkpatch.pl to report 'suspect code indent' and 'statements
should start on a tabstop' warnings.
Detected by checkpatch.pl with --strict flag.
Signed-off-by: Praveen Jayaprakash Pattar <praveen.pattar2022@gmail.com>
Link: https://patch.msgid.link/20260531040420.5426-1-praveen.pattar2022@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Correct spaces or mix of tabs+spaces into proper tab-indented lines and
remove other whitespace violations. No functional impact (same DTB).
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
The 'for' loop in ODM_TXPowerTrackingCallback_ThermalMeter performs no
operations and just iterates over the path count. This is unnecessary code.
Also, remove the associated "Print Swing base & current" comment, as
it no longer refers to any active code.
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Link: https://patch.msgid.link/20260525121004.4989-1-igorpetindev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rename the variable 'nSubframe_Length' to 'subframe_len' in
amsdu_to_msdu() and rtw_alloc_msdu_pkt() to resolve a
checkpatch.pl CamelCase warning.
Signed-off-by: Anirban Bose <boses156@gmail.com>
Link: https://patch.msgid.link/20260525074419.144884-1-boses156@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix non-standard block comment format. The comment was using '/*++'
and '--*/' delimiters instead of the standard '/*' and '*/' used in
kernel coding style. Also fix missing '*' prefix on subsequent lines
and remove space before tab characters.
Detected by checkpatch.pl with --strict flag.
Signed-off-by: Praveen Jayaprakash Pattar <praveen.pattar2022@gmail.com>
Link: https://patch.msgid.link/20260524152506.5670-1-praveen.pattar2022@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove unnecessary braces around a single statement block
to improve readability and conform to kernel coding style.
No functional changes intended.
Signed-off-by: Atharv Margur <atharvmargur@gmail.com>
Link: https://patch.msgid.link/20260524111736.14477-1-atharvmargur@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through
the multicast list and calls ip_ma_put() on each membership, scheduling
them for RCU reclamation. However, they are not unlinked from the device's
multicast hash table (mc_hash).
Since the device remains published in dev->ip_ptr until after
ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash
can still locate and access the multicast group after its refcount is
decremented. If the RCU callback runs and frees the group while a reader is
accessing it, a use-after-free occurs.
Fix this by unlinking the multicast group from mc_hash using
ip_mc_hash_remove() before scheduling it for reclamation.
BUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0
Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276
Call Trace:
<IRQ>
dump_stack_lvl+0x67/0x90
print_report+0x175/0x7c0
kasan_report+0x147/0x180
ip_check_mc_rcu+0x149/0x3f0
udp_v4_early_demux+0x36d/0x12d0
ip_rcv_finish_core+0xb8b/0x1390
ip_rcv_finish+0x54/0x120
NF_HOOK+0x213/0x2b0
__netif_receive_skb+0x126/0x340
process_backlog+0x4f2/0xf00
__napi_poll+0x92/0x2c0
net_rx_action+0x583/0xc60
handle_softirqs+0x236/0x7f0
do_softirq+0x57/0x80
</IRQ>
Allocated by task 2239:
kasan_save_track+0x3e/0x80
__kasan_kmalloc+0x72/0x90
____ip_mc_inc_group+0x31a/0xa40
__ip_mc_join_group+0x334/0x3f0
do_ip_setsockopt+0x16fa/0x2010
ip_setsockopt+0x3f/0x90
do_sock_setsockopt+0x1ad/0x300
Freed by task 0:
kasan_save_track+0x3e/0x80
kasan_save_free_info+0x40/0x50
__kasan_slab_free+0x3a/0x60
__rcu_free_sheaf_prepare+0xd4/0x220
rcu_free_sheaf+0x36/0x190
rcu_core+0x8d9/0x12f0
handle_softirqs+0x236/0x7f0
Fixes: e989707135 ("igmp: hash a hash table to speedup ip_check_mc_rcu()")
Cc: stable@vger.kernel.org
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260701235014.73505-1-yuyanghuang@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Detected the following WARNING: function definition argument
'struct adapter *' should also have an identifier name.
Add explicit names on those definitions.
Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
Link: https://patch.msgid.link/20260609221200.123422-1-rodrigo.gobbi.7@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix checkpatch warnings on inconsistent braces around if/else statements
in hal/sdio_halinit.c
Signed-off-by: Artur Ugnivenko <artur.ugnivenko@gmx.de>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260528170645.30861-3-artur.ugnivenko@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix checkpatch warnings on lines above 100 chars in length by splitting
long function calls and long comments into multiple lines.
Signed-off-by: Artur Ugnivenko <artur.ugnivenko@gmx.de>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260528170645.30861-2-artur.ugnivenko@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
padapter->HalData is allocated via vzalloc(), but incorrectly freed
using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to
release this vmalloc-backed buffer can lead to memory corruption.
Use rtw_hal_data_deinit() to pair the free correctly and free
HalData with vfree().
The bug was first flagged by an experimental static analysis tool we
are developing for kernel memory-management bugs. Manual inspection
confirms that the issue is still present in current mainline.
An x86_64 allyesconfig build showed no new warnings. As we do not have
suitable RTL8723BS SDIO hardware to test with, no runtime testing was
able to be performed.
Fixes: 554c0a3abf ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260525091836.812565-1-dawei.feng@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rename RxMgmtFrameSeqNum to rx_mgmt_frame_seq_num to comply with
kernel coding style.
Found by checkpatch.pl strict.
Signed-off-by: Gianmaria Biselli <gianmariabiselli@gmail.com>
Link: https://patch.msgid.link/20260524031212.26208-1-gianmariabiselli@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
