Commit graph

1,403,262 commits

Author SHA1 Message Date
Lucas De Marchi
2b7eec2ec3 usb: early: xhci-dbc: Fix early_ioremap leak
Using the kernel param earlyprintk=xdbc,keep without proper hardware
setup leads to this:

	[ ] xhci_dbc:early_xdbc_parse_parameter: dbgp_num: 0
	...
	[ ] xhci_dbc:early_xdbc_setup_hardware: failed to setup the connection to host
	...
	[ ] calling  kmemleak_late_init+0x0/0xa0 @ 1
	[ ] kmemleak: Kernel memory leak detector initialized (mem pool available: 14919)
	[ ] kmemleak: Automatic memory scanning thread started
	[ ] initcall kmemleak_late_init+0x0/0xa0 returned 0 after 417 usecs
	[ ] calling  check_early_ioremap_leak+0x0/0x70 @ 1
	[ ] ------------[ cut here ]------------
	[ ] Debug warning: early ioremap leak of 1 areas detected.
	    please boot with early_ioremap_debug and report the dmesg.
	[ ] WARNING: CPU: 11 PID: 1 at mm/early_ioremap.c:90 check_early_ioremap_leak+0x4e/0x70

When early_xdbc_setup_hardware() fails, make sure to call
early_iounmap() since xdbc_init() won't handle it.

Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Fixes: aeb9dd1de9 ("usb/early: Add driver for xhci debug capability")
Link: https://lore.kernel.org/r/20250627-xdbc-v1-1-43cc8c317b1b@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-07 11:04:46 +02:00
Greg Kroah-Hartman
0c43c19bf7 thunderbolt: Changes for v6.17 merge window
This includes just a single trivial documentation fix. It has been in
 linux-next with no reported issues.
 -----BEGIN PGP SIGNATURE-----
 
 iQJUBAABCgA+FiEEVTdhRGBbNzLrSUBaAP2fSd+ZWKAFAmhdZzEgHG1pa2Eud2Vz
 dGVyYmVyZ0BsaW51eC5pbnRlbC5jb20ACgkQAP2fSd+ZWKCSzw//SKH/44JLY4aJ
 CeyCeH+xNl57xfNMyumqnrrbxWcm2bnjcVByCAAw88fgqDWlrf79YuS5Z9GUR5lf
 4NpGDo2pGunZ6P5yghCejban+Lz+aFzhKE8Mb1aOWvq4JGVWGb4GIzXKq89Ac9vs
 ytm4cZcGz9j45VSZvIXJsNnfM3eH3VZWOElvgerCFl+JnbInGASVmu6zmEdmZ2Bw
 L8fftXUfj1GvSgiwWdThy/c+g/p2O/S4+uvE3YyRyuu9VByn7HWme+E7InHRAULS
 IHWCrxDRw+PqtbP8jT0Dk8enRiwTchWSpaeocElw/aWzUlQ2jzjMLgRDQq1rpYV+
 /aImtvbBLI10LVl9BbEom1NYYFxDYOYU58S7CqhiKJ2UbYmwPATDknnMel7Y5NHw
 W/IeCXeljif57VzwNhPB/+s4L9tC1ffMJp2F+PETDaHze94q5Vdqqmk6+CapZKyE
 870Xeo0pqAAuoE8wmgt73u+EQ0EYWYVOx5TFKbcl/pun+4nJttPsodR2MRo4WcXF
 hdroWVdyS9Xe74lug4UEYglJZeuEv2twVNAQAhlobEkrJSGf1eyXIDsdOVdULmQQ
 LJTh2DfKNykzwo7GR6EWhsR3kfF14zQhSBjksLnSgxbaUZvyZN1iTLXwjwIEDk4c
 sfOtLrGAsmLwIrh+TNMOJDKuV0CX2gw=
 =MaAT
 -----END PGP SIGNATURE-----

Merge tag 'thunderbolt-for-v6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next

Mika writes:

thunderbolt: Changes for v6.17 merge window

This includes just a single trivial documentation fix. It has been in
linux-next with no reported issues.

* tag 'thunderbolt-for-v6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt:
  thunderbolt: Fix typos in documentation comments
2025-07-07 11:03:53 +02:00
Yuhao Jiang
62783c30d7 USB: gadget: f_hid: Fix memory leak in hidg_bind error path
In hidg_bind(), if alloc_workqueue() fails after usb_assign_descriptors()
has successfully allocated the USB descriptors, the current error handling
does not call usb_free_all_descriptors() to free the allocated descriptors,
resulting in a memory leak.

Restructure the error handling by adding proper cleanup labels:
- fail_free_all: cleans up workqueue and descriptors
- fail_free_descs: cleans up descriptors only
- fail: original cleanup for earlier failures

This ensures that allocated resources are properly freed in reverse order
of their allocation, preventing the memory leak when alloc_workqueue() fails.

Fixes: a139c98f76 ("USB: gadget: f_hid: Add GET_REPORT via userspace IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Yuhao Jiang <danisjiang@gmail.com>
Link: https://lore.kernel.org/r/20250623094844.244977-1-danisjiang@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-07 11:03:33 +02:00
Drew Hamilton
67a59f8219 usb: musb: fix gadget state on disconnect
When unplugging the USB cable or disconnecting a gadget in usb peripheral mode with
echo "" > /sys/kernel/config/usb_gadget/<your_gadget>/UDC,
/sys/class/udc/musb-hdrc.0/state does not change from USB_STATE_CONFIGURED.

Testing on dwc2/3 shows they both update the state to USB_STATE_NOTATTACHED.

Add calls to usb_gadget_set_state in musb_g_disconnect and musb_gadget_stop
to fix both cases.

Fixes: 49401f4169 ("usb: gadget: introduce gadget state tracking")
Cc: stable@vger.kernel.org
Co-authored-by: Yehowshua Immanuel <yehowshua.immanuel@twosixtech.com>
Signed-off-by: Yehowshua Immanuel <yehowshua.immanuel@twosixtech.com>
Signed-off-by: Drew Hamilton <drew.hamilton@zetier.com>
Link: https://lore.kernel.org/r/20250701154126.8543-1-drew.hamilton@zetier.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-07 10:58:15 +02:00
Frank Wunderlich
bc51660cd5
arm64: dts: mediatek: mt7988a-bpi-r4: drop unused pins
Pins were moved from SoC dtsi to Board level dtsi without cleaning up
to needed ones. Drop the unused pins now.

Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250706132213.20412-13-linux@fw-web.de
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:57:03 +02:00
Frank Wunderlich
b5a4ad9571
arm64: dts: mediatek: mt7988a-bpi-r4: add proc-supply for cci
CCI requires proc-supply. Add it on board level.

Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250706132213.20412-12-linux@fw-web.de
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:57:03 +02:00
Frank Wunderlich
0cbdb6d046
arm64: dts: mediatek: mt7988: add cci node
Add cci devicetree node for cpu frequency scaling.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250706132213.20412-9-linux@fw-web.de
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:57:03 +02:00
Frank Wunderlich
bd9e0f5d90
dt-bindings: interconnect: add mt7988-cci compatible
Add compatible for Mediatek MT7988 SoC with mediatek,mt8183-cci fallback
which is taken by driver.

Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Acked-by: Georgi Djakov <djakov@kernel.org>
Link: https://lore.kernel.org/r/20250706132213.20412-8-linux@fw-web.de
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:57:03 +02:00
Mathy Vanhoef
737bb912eb wifi: prevent A-MSDU attacks in mesh networks
This patch is a mitigation to prevent the A-MSDU spoofing vulnerability
for mesh networks. The initial update to the IEEE 802.11 standard, in
response to the FragAttacks, missed this case (CVE-2025-27558). It can
be considered a variant of CVE-2020-24588 but for mesh networks.

This patch tries to detect if a standard MSDU was turned into an A-MSDU
by an adversary. This is done by parsing a received A-MSDU as a standard
MSDU, calculating the length of the Mesh Control header, and seeing if
the 6 bytes after this header equal the start of an rfc1042 header. If
equal, this is a strong indication of an ongoing attack attempt.

This defense was tested with mac80211_hwsim against a mesh network that
uses an empty Mesh Address Extension field, i.e., when four addresses
are used, and when using a 12-byte Mesh Address Extension field, i.e.,
when six addresses are used. Functionality of normal MSDUs and A-MSDUs
was also tested, and confirmed working, when using both an empty and
12-byte Mesh Address Extension field.

It was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh
networks keep being detected and prevented.

Note that the vulnerability being patched, and the defense being
implemented, was also discussed in the following paper and in the
following IEEE 802.11 presentation:

https://papers.mathyvanhoef.com/wisec2025.pdf
https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx

Cc: stable@vger.kernel.org
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://patch.msgid.link/20250616004635.224344-1-Mathy.Vanhoef@kuleuven.be
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-07 10:54:13 +02:00
Lorenzo Bianconi
d172b9237e
arm64: dts: airoha: en7581: Add ethernet nodes to EN7581 SoC evaluation board
Introduce ethernet controller nodes to EN7581 SoC and EN7581 evaluation
board.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/20250520-en7581-net-v1-1-5317f8e829ad@kernel.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:53:05 +02:00
Laura Nao
1fcb7608a0
arm64: dts: mediatek: mt8192-asurada-spherion: Mark trackpads as fail-needs-probe
Different Spherion variants use different trackpads on the same I2C2
bus. Instead of enabling all of them by default, mark them as
"fail-needs-probe" and let the implementation determine which one is
actually present.

Additionally, move the trackpad pinctrl entry back to the individual
trackpad nodes.

Signed-off-by: Laura Nao <laura.nao@collabora.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20250318102259.189289-3-laura.nao@collabora.com
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:53:05 +02:00
Chen-Yu Tsai
85c767d2d3
arm64: dts: mediatek: mt8186: Add Squirtle Chromebooks
Add a device tree for the MT8186 based Squirtle Chromebooks, also known
as the Acer Chromebook Spin 311 (R724T). The device is a 2-in-1
convertible.

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20250617082004.1653492-7-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:53:05 +02:00
Chen-Yu Tsai
57ac6f86ee
arm64: dts: mediatek: mt8186: Merge Voltorb device trees
There are only two different SKUs of Voltorb, and the only difference
between them is whether a touchscreen is present or not. This can be
detected by a simple I2C transfer to the address, instead of having
separate device trees.

Merge the two device trees together and simplify the compatible string
list. The dtsi is still kept separate since there is an incoming device
that shares the same design, but with slightly difference components.

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20250617082004.1653492-6-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:53:04 +02:00
Chen-Yu Tsai
8609434f64
arm64: dts: mediatek: mt8186-steelix: Mark second source components for probing
Steelix design has two possible trackpad component sources. Currently
they are all marked as available, along with having workarounds for
shared pinctrl muxing and GPIOs.

Instead, mark them all as "fail-needs-probe" and have the implementation
try to probe which one is present.

Also remove the shared resource workaround by moving the pinctrl entry
for the trackpad interrupt line back into the individual trackpad nodes.

Cc: stable+noautosel@kernel.org # Needs accompanying new driver to work
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20250617082004.1653492-5-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:53:04 +02:00
Chen-Yu Tsai
8101382c24
dt-bindings: arm: mediatek: Add MT8186 Squirtle Chromebooks
Add an entry for the MT8186 based Squirtle Chromebooks, also known as the
Acer Chromebook Spin 311 (R724T). The device is a 2-in-1 convertible.

Acked-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20250617082004.1653492-4-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:53:04 +02:00
Chen-Yu Tsai
32239b8900
dt-bindings: arm: mediatek: Merge MT8186 Voltorb entries
There are only two different SKUs of Voltorb, and the only difference
between them is whether a touchscreen is present or not. This can be
detected by a simple I2C transfer to the address, instead of having
separate compatible strings and device trees.

Drop the SKU-specific compatible strings and just keep the generic
"google,voltorb" one.

Acked-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20250617082004.1653492-3-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2025-07-07 10:53:03 +02:00
Greg Kroah-Hartman
9fccced2d2 thunderbolt: Fixes for v6.16-rc4
This includes following USB4/Thunderbolt fixes for v6.16-rc4:
 
   - Fix wake on connect during runtime suspend
   - Fix bit masking in tb_dp_port_set_hops().
 
 Both have been in linux-next with no reported issues.
 -----BEGIN PGP SIGNATURE-----
 
 iQJUBAABCgA+FiEEVTdhRGBbNzLrSUBaAP2fSd+ZWKAFAmhdZdIgHG1pa2Eud2Vz
 dGVyYmVyZ0BsaW51eC5pbnRlbC5jb20ACgkQAP2fSd+ZWKB2yg/7BX3lF55Ziezp
 RhM9MD+8W0z6QMizfYoa6L2iyz4v5dVCuENfE9CuzUkzwab0GsklN3EdOBg2n3/J
 FEB4i7YKF7aIEo+nO0unr2DmsdiBVrKToKZsSfR879OntrkLMvijv5xRGcvFR1/A
 vhi77CpZRmXjwOC50YcCiK7PtBLopn0jG0oct5Ac8vssLgCwq5nUw0D5QXOU1n+F
 XB9d6xTVysCjDkUniu4psuKzhL+I+X7BFG1xZilco/Lp8vv8RAr7RyLiyEKKi16V
 JsHQFOPuxLP+0qV5bu2+kh1UPkwfuH+nfQE0YNqAO7yRdoNP7mNckJ1e8jsNccS9
 UwreFRiYOTtozAmpoNU8BryqwiaZn3uNJLsriTk/3qI86tvdhdszCcpCISDLV4oQ
 cPUNeUiRkeCeev+FpIgUY5e+QxQJewYduLikAkt9zVQ8tMWKWo4vN2B700LgOSIY
 FW0zzQ3rRjbjTQxHhRBwN/EE0a94EocP45VvS8+8F9i4VxDX8hpO/rDp7DpdNuAB
 faABtooUmw5KrhhhfrqjajQzYMaUhHFpeQJy/Sjl3NSUL/Ms6SOeFtYbf+2PaA1S
 BPvKUPFlR3PAEKUmOv+jGApaAhU9CnXsTEI4/0bYelqV+1WAUjfqotUl/SZmiQUT
 kLNh7P9BwRMHweeokdTbjpsCWELS1Ok=
 =3Mwe
 -----END PGP SIGNATURE-----

Merge tag 'thunderbolt-for-v6.16-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus

Mika writes:

thunderbolt: Fixes for v6.16-rc4

This includes following USB4/Thunderbolt fixes for v6.16-rc4:

  - Fix wake on connect during runtime suspend
  - Fix bit masking in tb_dp_port_set_hops().

Both have been in linux-next with no reported issues.

* tag 'thunderbolt-for-v6.16-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt:
  thunderbolt: Fix bit masking in tb_dp_port_set_hops()
  thunderbolt: Fix wake on connect at runtime
2025-07-07 10:49:54 +02:00
Felix Fietkau
2ce6ad9262 wifi: rt2x00: fix remove callback type mismatch
The function is used as remove callback for a platform driver.
It was missed during the conversion from int to void

Fixes: 0edb555a65 ("platform: Make platform_driver::remove() return void")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://patch.msgid.link/20250706092053.97724-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-07 10:45:43 +02:00
Moon Hee Lee
58fcb1b428 wifi: mac80211: reject VHT opmode for unsupported channel widths
VHT operating mode notifications are not defined for channel widths
below 20 MHz. In particular, 5 MHz and 10 MHz are not valid under the
VHT specification and must be rejected.

Without this check, malformed notifications using these widths may
reach ieee80211_chan_width_to_rx_bw(), leading to a WARN_ON due to
invalid input. This issue was reported by syzbot.

Reject these unsupported widths early in sta_link_apply_parameters()
when opmode_notif is used. The accepted set includes 20, 40, 80, 160,
and 80+80 MHz, which are valid for VHT. While 320 MHz is not defined
for VHT, it is allowed to avoid rejecting HE or EHT clients that may
still send a VHT opmode notification.

Reported-by: syzbot+ededba317ddeca8b3f08@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ededba317ddeca8b3f08
Fixes: 751e7489c1 ("wifi: mac80211: expose ieee80211_chan_width_to_rx_bw() to drivers")
Tested-by: syzbot+ededba317ddeca8b3f08@syzkaller.appspotmail.com
Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
Link: https://patch.msgid.link/20250703193756.46622-2-moonhee.lee.ca@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-07 10:45:21 +02:00
Vitor Soares
3b602ddc0d wifi: mwifiex: discard erroneous disassoc frames on STA interface
When operating in concurrent STA/AP mode with host MLME enabled,
the firmware incorrectly sends disassociation frames to the STA
interface when clients disconnect from the AP interface.
This causes kernel warnings as the STA interface processes
disconnect events that don't apply to it:

[ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211]
[ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us
[ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT
[ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT)
[ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex]
[ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211]
[ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211]
[ 1303.370221] sp : ffff800083053be0
[ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 0000000000000000
[ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae
[ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008
[ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006
[ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048
[ 1303.409910] x14: ffff000003625300 x13: 0000000000000001 x12: 0000000000000000
[ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300
[ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002
[ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186
[ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de
[ 1303.446221] Call trace:
[ 1303.448722]  cfg80211_process_disassoc+0x78/0xec [cfg80211] (P)
[ 1303.454894]  cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211]
[ 1303.460362]  mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex]
[ 1303.466380]  mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex]
[ 1303.472573]  mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex]
[ 1303.478243]  mwifiex_rx_work_queue+0x158/0x198 [mwifiex]
[ 1303.483734]  process_one_work+0x14c/0x28c
[ 1303.487845]  worker_thread+0x2cc/0x3d4
[ 1303.491680]  kthread+0x12c/0x208
[ 1303.495014]  ret_from_fork+0x10/0x20

Add validation in the STA receive path to verify that disassoc/deauth
frames originate from the connected AP. Frames that fail this check
are discarded early, preventing them from reaching the MLME layer and
triggering WARN_ON().

This filtering logic is similar with that used in the
ieee80211_rx_mgmt_disassoc() function in mac80211, which drops
disassoc frames that don't match the current BSSID
(!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring
only relevant frames are processed.

Tested on:
- 8997 with FW 16.68.1.p197

Fixes: 36995892c2 ("wifi: mwifiex: add host mlme for client mode")
Cc: stable@vger.kernel.org
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20250701142643.658990-1-ivitro@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-07 10:44:40 +02:00
Johannes Berg
e1e6ebf490 wifi: mac80211: fix non-transmitted BSSID profile search
When the non-transmitted BSSID profile is found, immediately return
from the search to not return the wrong profile_len when the profile
is found in a multiple BSSID element that isn't the last one in the
frame.

Fixes: 5023b14cf4 ("mac80211: support profile split between elements")
Reported-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
Link: https://patch.msgid.link/20250630154501.f26cd45a0ecd.I28e0525d06e8a99e555707301bca29265cf20dc8@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-07 10:42:48 +02:00
Johannes Berg
8af596e8ae wifi: mac80211: clear frame buffer to never leak stack
In disconnect paths paths, local frame buffers are used
to build deauthentication frames to send them over the
air and as notifications to userspace. Some internal
error paths (that, given no other bugs, cannot happen)
don't always initialize the buffers before sending them
to userspace, so in the presence of other bugs they can
leak stack content. Initialize the buffers to avoid the
possibility of this happening.

Suggested-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
Link: https://patch.msgid.link/20250701072213.13004-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-07 10:42:36 +02:00
Lachlan Hodges
c5fd399a24 wifi: mac80211: correctly identify S1G short beacon
mac80211 identifies a short beacon by the presence of the next
TBTT field, however the standard actually doesn't explicitly state that
the next TBTT can't be in a long beacon or even that it is required in
a short beacon - and as a result this validation does not work for all
vendor implementations.

The standard explicitly states that an S1G long beacon shall contain
the S1G beacon compatibility element as the first element in a beacon
transmitted at a TBTT that is not a TSBTT (Target Short Beacon
Transmission Time) as per IEEE80211-2024 11.1.3.10.1. This is validated
by 9.3.4.3 Table 9-76 which states that the S1G beacon compatibility
element is only allowed in the full set and is not allowed in the
minimum set of elements permitted for use within short beacons.

Correctly identify short beacons by the lack of an S1G beacon
compatibility element as the first element in an S1G beacon frame.

Fixes: 9eaffe5078 ("cfg80211: convert S1G beacon to scan results")
Signed-off-by: Simon Wadsworth <simon@morsemicro.com>
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
Link: https://patch.msgid.link/20250701075541.162619-1-lachlan.hodges@morsemicro.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-07-07 10:42:15 +02:00
Bartosz Golaszewski
ac725f9780 Runtime PM updates related to autosuspend for 6.17
Make several autosuspend functions mark last busy stamp and update
 the documentation accordingly (Sakari Ailus).
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmhjrvQSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1aigIAKypscFSfd/WsAlP4orLtd4xiLi7KQHa
 NrOYv7sZBVHgx4S9BGqHavYM3qhOBH5qCg+yBtqb8v6vp/TIlJjF2v3+C8uAXAnl
 9GI5Gc6sZp/lMhf5Vb4Ibf58/P9lg4A7mIvM+LtfeEUMTlRrp47Q/RQ0ah7S4tDj
 rFyC92QmBnkDLoyQp5IbCWkdjlqGgyTZzz/+XnfV9fWwX1aiXqaB4EZ2nXSAlyBx
 awvA4/t662SWlHsdQqll9vS/+ZB39LEWwa1jJ7XGIK8t6GSH+TTys3S9/PHR/ua3
 Dlcd+14plDGlSOy97hY+z6NdSgxH/qcpRgFduu5KwVqEwo2fqNkeV9Q=
 =pFYw
 -----END PGP SIGNATURE-----

Merge tag 'pm-runtime-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm into gpio/for-next

Runtime PM updates related to autosuspend for 6.17

Make several autosuspend functions mark last busy stamp and update
the documentation accordingly (Sakari Ailus).
2025-07-07 10:00:33 +02:00
Thorsten Blum
3263a554f3 ALSA: mts64: Replace deprecated strcpy() with strscpy()
strcpy() is deprecated; use strscpy() instead.

No functional changes intended.

Link: https://github.com/KSPP/linux/issues/88
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20250706160906.416270-1-thorsten.blum@linux.dev
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-07-07 09:57:09 +02:00
Manivannan Sadhasivam
c1dc61aede PCI: dwc: Make dw_pcie_ptm_ops static
dw_pcie_ptm_ops is not used outside of this file, so make it static. This
also fixes the sparse warning:

  drivers/pci/controller/dwc/pcie-designware-debugfs.c:868:27: warning: symbol 'dw_pcie_ptm_ops' was not declared. Should it be static?

Fixes: 852a1fdd34 ("PCI: dwc: Add debugfs support for PTM context")
Reported-by: Bjorn Helgaas <helgaas@kernel.org>
Closes: https://lore.kernel.org/linux-pci/20250617231210.GA1172093@bhelgaas
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20250701120856.15839-1-mani@kernel.org
2025-07-07 13:23:15 +05:30
Bartosz Golaszewski
e3ec7ad5ab gpio: tps6586x: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-12-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
fc0e4091af gpio: tps65219: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-11-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
4ca81a1f3a gpio: tps65218: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-10-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
913cbf8a0d gpio: tps65218: remove unneeded callbacks
GPIO core can handle output-only chips that don't implement the get()
and direction_input() callbacks. There's no need to provide dummy
implementation of the latter in the driver so drop it.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-9-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
2a5be7a80b gpio: tps65086: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-8-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
4ffdd9d8a3 gpio: tpic2810: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-7-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
00c337cc68 gpio: tpic2810: remove unneeded callbacks
GPIO core can handle output-only chips that don't implement the get()
and direction_input() callbacks. There's no need to provide dummy
implementation of the latter in the driver so drop it.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-6-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
dd66f8862f gpio: timberdale: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-5-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
ecf0c0278f gpio: thunderx: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-4-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:30 +02:00
Bartosz Golaszewski
8a81d128e1 gpio: tegra: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-3-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:29 +02:00
Bartosz Golaszewski
871e1aee00 gpio: tegra186: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-2-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:29 +02:00
Bartosz Golaszewski
47c228d9fc gpio: tegra186: don't call the set() callback directly
Drivers should not dereference GPIO chip callbacks directly. Move the
module's set() function higher to make it available to the
direction_output() callback and call it instead.

Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-1-0d23be74f71d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:45:29 +02:00
Bartosz Golaszewski
34c029c203 gpio: en7523: use new generic GPIO chip API
Convert the driver to using the new generic GPIO chip interfaces from
linux/gpio/generic.h.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-8-6b77aab684d8@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:43:53 +02:00
Bartosz Golaszewski
bd9a0dec2d gpio: 74xx-mmio: use new generic GPIO chip API
Convert the driver to using the new generic GPIO chip interfaces from
linux/gpio/generic.h.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-7-6b77aab684d8@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:43:53 +02:00
Bartosz Golaszewski
47ecff3839 gpio: cadence: use new generic GPIO chip API
Convert the driver to using the new generic GPIO chip interfaces from
linux/gpio/generic.h.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-6-6b77aab684d8@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:43:53 +02:00
Bartosz Golaszewski
76045e9040 gpio: cadence: use lock guards
Simplify the code by using lock guards for the bgpio_lock. While at it:
move the gpio/driver.h include into its correct place alphabetically.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-5-6b77aab684d8@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:43:53 +02:00
Bartosz Golaszewski
fd0f0d1a1e gpio: clps711x: use new generic GPIO chip API
Convert the driver to using the new generic GPIO chip interfaces from
linux/gpio/generic.h.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-4-6b77aab684d8@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:43:53 +02:00
Bartosz Golaszewski
1f129b15c2 gpio: mxc: use new generic GPIO chip API
Convert the driver to using the new generic GPIO chip interfaces from
linux/gpio/generic.h.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-3-6b77aab684d8@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:43:53 +02:00
Bartosz Golaszewski
ba441322c7 gpio: mxc: use lock guards for the generic GPIO chip lock
Simplify the code by using lock guards for the bgpio_lock.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-2-6b77aab684d8@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:43:52 +02:00
Bartosz Golaszewski
8595375e4f gpio: generic: add new generic GPIO chip API
As the first step in removing the fields specific to the gpio-mmio
module from struct gpio_chip, we introduce a new set of generic GPIO
chip interfaces that are meant to replace the existing bgpio_ ones.

The new initialization function - gpio_generic_chip_init() - takes a
configuration structure as argument instead of 9 separate parameters.
This will allow easy extension if needed in the future. We hide the
locking details behind a set of helpers in order to be able to move the
raw spinlock out of struct gpio_chip without the users noticing.

For now, the new APIs just wrap the existing ones. Once all users have
been converted to the new interfaces, we'll pull them into gpio-mmio and
implement them in a backward-compatible way while also moving all fields
specific to the generic GPIO chip into struct gpio_generic_chip.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-1-6b77aab684d8@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:43:52 +02:00
Bartosz Golaszewski
179a666951 Immutable branch between GPIO, MFD and ARM-SoC for v6.17-rc1
Remove struct bgpio_pdata after converting its users to generic device
 properties.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFp3rbAvDxGAT0sefEacuoBRx13IFAmhreU4ACgkQEacuoBRx
 13LIJQ//VJTGNN3xgAVop4t9aMa+4OBnE1F8l18Di8H8/ZOe7PiAc6BAleioHl+h
 zuc6uwgOZQUnUdEAYRVHkQJnI/1N65PO+DUFGQD4pABM7R1oW37aE7VNnW5HkjWh
 WQl1mxIBdKyuR65HbCS76Ek/WzP3Qh37yNSS1gI9ISbbbHW77A3w88miBZwFVRof
 KcNGM+oARbJC8ARAw+i+HsVODTouE7fH2Tr8aum2OExZs+wjroi3iLQQaup2lb9Y
 gZzNN/pdOktVjk0/7HRJI/9zRDDxR3N7S/KXsyBd7vBfvM/RDqFHq8/o7K+HrXR1
 pxp5fqqW29S82P2+7YTnU65pLJeyC2oEWwGJN+bB46dVG8BEBAa1s94UVCJF4Zq5
 /rC69U5NxBL7XUolQ9WxiEXXlh1c0unlH/CJMiXcllR3DpYls3MIfymWKQvomve8
 z7ub6gWTal0oW9TO3y8flPHBBslS0pZCgqmdenJdoLc+rc+cQRt2hmaquaOMbPqR
 kqK+NI4aBdJ9JessW7I4zrWLRD8LhzT2zidyLgDwN1ghck1WD/Of0g7M8I1U2AZN
 LmXRdPmDrHpKV7E/x3+Clsmq9n1A6q7i0PEcON1cv99LofK3vIWe3eBZvVyySnT7
 szjVqngNlzePbRTTlsRcaOYPCcHu3yNxmLPwynqvL/pjjmJqaPQ=
 =k0Ui
 -----END PGP SIGNATURE-----

Merge tag 'gpio-mmio-remove-bgpio-pdata-for-v6.17-rc1' into gpio/for-next

Immutable branch between GPIO, MFD and ARM-SoC for v6.17-rc1

Remove struct bgpio_pdata after converting its users to generic device
properties.
2025-07-07 09:42:37 +02:00
Francesco Dolcini
fbe94be09f arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
LDO5 regulator is used to power the i.MX8MM NVCC_SD2 I/O supply, that is
used for the SD2 card interface and also for some GPIOs.

When the SD card interface is not enabled the regulator subsystem could
turn off this supply, since it is not used anywhere else, however this
will also remove the power to some other GPIOs, for example one I/O that
is used to power the ethernet phy, leading to a non working ethernet
interface.

[   31.820515] On-module +V3.3_1.8_SD (LDO5): disabling
[   31.821761] PMIC_USDHC_VSELECT: disabling
[   32.764949] fec 30be0000.ethernet end0: Link is Down

Fix this keeping the LDO5 supply always on.

Cc: stable@vger.kernel.org
Fixes: 6a57f224f7 ("arm64: dts: freescale: add initial support for verdin imx8m mini")
Fixes: f5aab0438e ("regulator: pca9450: Fix enable register for LDO5")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-07-07 15:36:41 +08:00
Bartosz Golaszewski
9bad4bec5d gpio: mmio: remove struct bgpio_pdata
With no more users, we can now remove struct bgpio_pdata. Move the
relevant bits from bgpio_parse_fw() into bgpio_pdev_probe() while
maintaining the logical ordering (get flags before calling
bgpio_init()).

Link: https://lore.kernel.org/r/20250701-gpio-mmio-pdata-v2-6-ebf34d273497@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:31:08 +02:00
Bartosz Golaszewski
bb9c88d5b0 ARM: s3c: crag6410: use generic device properties for gpio-mmio
The GPIO device in crag6410 is registered with struct bgpio_pdata passed
as platform_data to the gpio-mmio driver. We want to remove the
bgpio_pdata from the kernel and the gpio-mmio driver is now also able to
get the relevant values from the software node. Set up device properties
and switch to using platform_device_info to register the device as
platform_add_devices() doesn't allow us to pass device properties to the
driver model.

Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20250701-gpio-mmio-pdata-v2-5-ebf34d273497@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-07 09:31:08 +02:00