Commit graph

1,461,726 commits

Author SHA1 Message Date
Linus Probert
abb42e4d23 staging: rtl8723bs: rename EFUSE_Read1Byte() to rtw_efuse_read_1_byte()
Renames EFUSE_Read1Byte to rtw_efuse_read_1_byte in order to conform to
kernel code style.

Discovered using checkpatch.pl tool.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260403223327.1831215-4-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:53 -06:00
Linus Probert
8cb5425cd8 staging: rtl8723bs: efuse_OneByteRead() -> rtw_efuse_one_byte_read()
Renames efuse_OneByteRead to rtw_efuse_one_byte_read in order to conform
to kernel coding style.

Discovered using the checkpatch.pl tool.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260403223327.1831215-3-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:53 -06:00
Linus Probert
6801cdb0f7 staging: rtl8723bs: rename global function Efuse_CalculateWordCnts
Renames the function Efuse_CalculateWordCnts to
rtw_efuse_calculate_word_counts in order to conform to linux code style.

Discovered with checkpatch.pl tool.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260403223327.1831215-2-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:53 -06:00
Hungyu Lin
b4c71a9978 staging: rtl8723bs: convert _rtw_init_xmit_priv to return errno
Convert _rtw_init_xmit_priv() to return 0 on success and
negative error codes on failure. Update the caller to
check for non-zero return values.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260408111314.19329-7-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:53 -06:00
Hungyu Lin
f5be742ee9 staging: rtl8723bs: convert rtw_os_xmit_resource_alloc to return errno
Convert rtw_os_xmit_resource_alloc() to return 0 on success
and -ENOMEM on failure. Update the callers to check for
non-zero return values.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260408111314.19329-6-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:53 -06:00
Hungyu Lin
e7c3d33739 staging: rtl8723bs: move rtw_os_xmit_resource_alloc to rtw_xmit.c
Move rtw_os_xmit_resource_alloc() into core/rtw_xmit.c and make
it static so the xmit init helpers live together.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260408111314.19329-5-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:53 -06:00
Hungyu Lin
312989a3b0 staging: rtl8723bs: convert rtw_alloc_hwxmits to return errno
Convert rtw_alloc_hwxmits() to return 0 on success and
-ENOMEM on failure. Update the caller to check for
non-zero return values.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260408111314.19329-4-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Hungyu Lin
76b4ffc748 staging: rtl8723bs: make rtw_alloc_hwxmits static
The rtw_alloc_hwxmits() function is only used within this file.
Make it static to limit its scope.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260408111314.19329-3-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Hungyu Lin
ab92b4aabf staging: rtl8723bs: simplify _rtw_init_xmit_priv control flow
Replace goto-based error handling in _rtw_init_xmit_priv()
with direct returns to simplify the control flow.

No functional changes intended.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260408111314.19329-2-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Paarth Mahadik
885b1d8379 staging: rtl8723bs: fix logical continuation style
Logical continuation should be on the previous line,
move && to the end of the preceding line and align
the continuation with the opening parenthesis.

Signed-off-by: Paarth Mahadik <paarth.mahadik@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260404072626.134642-1-paarth.mahadik@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Hungyu Lin
a2e327e2d0 staging: rtl8723bs: remove unnecessary parentheses in os_intfs.c
Remove redundant parentheses around &padapter->xmitpriv and
&padapter->recvpriv.

The parentheses are unnecessary and removing them improves readability.
No functional change.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260402231316.4243-1-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Linus Probert
9d3fb34054 staging: rtl8723bs: remove multiple blank lines in rtw_btcoex.c
Removes multiple blank lines in rtw_btcoex.c.
Discovered and verified using checkpatch.pl

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Link: https://patch.msgid.link/20260403220310.1824969-3-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Xiyuan Guo
b3e254c620 staging: rtl8723bs: fix include guard comment in rtw_cmd.h
The #endif comment at the bottom of the file mistakenly referred to
_CMD_H_ instead of the actual include guard macro __RTW_CMD_H_ defined
at the top of the file.

Signed-off-by: Xiyuan Guo <tommyguo039@gmail.com>
Link: https://patch.msgid.link/20260403011859.307665-1-tommyguo039@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Nikolay Kulikov
c31cf90807 staging: rtl8723bs: replace tabs used as separators with spaces
Replace tabs in variable initialization lines with spaces to make code
more consistent.

Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260402-cleanup_rtw_io-v1-2-874b9747de6b@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Nikolay Kulikov
0f8f9ab869 staging: rtl8723bs: remove dead code in rtw_io.c
Remove the commented variable declarations as they are not used
anywhere.

Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260402-cleanup_rtw_io-v1-1-874b9747de6b@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Ethan Tidmore
2143a136db staging: rtl8723bs: Rename pHT_info_ie to ht_info_ie
Convert variable pHT_info_ie to ht_info_ie to comply with snake_case and
to remove Hungarian notation.

Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260401021357.1176600-3-ethantidmore06@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Ethan Tidmore
9ef11656cc staging: rtl8723bs: Remove dead code
Remove commented out code and remove if statement with no body but a
line of commented out code.

Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260401021357.1176600-2-ethantidmore06@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:52 -06:00
Kosugi Souta
1fa2fa6866 staging: greybus: fix alignment to match open parenthesis
Fix the checkpatch.pl check "Alignment should match open parenthesis"
by adjusting the indentation in authenticate.c.

Signed-off-by: Kosugi Souta <k.souta0926@gmail.com>
Link: https://patch.msgid.link/20260404005939.116701-3-k.souta0926@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Kenet Jovan Sokoli
ec5f630241 staging: sm750fb: remove unused functions
The functions sm750_enable_i2c() and sm750_hw_cursor_set_data2() are
defined and declared but never used. Following the driver's TODO list
to remove unused code, this patch deletes these dead functions.

Verified by compilation and cppcheck.

Signed-off-by: Kenet Jovan Sokoli <deep@crimson.net.eu.org>
Link: https://patch.msgid.link/20260418143620.845355-1-deep@crimson.net.eu.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Ahmet Sezgin Duran
1121e30840 staging: sm750fb: fix off-by-one in lynxfb_ops_setcolreg
The bounds check used regno > 256 instead of regno >= 256,
allowing regno == 256. Valid indices are 0–255, resulting
in an out-of-bounds write.

Also remove the regno < 256 check in the truecolor path,
as it is always true with the corrected guard.

Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net>
Link: https://patch.msgid.link/20260408181210.9672-1-ahmet@sezginduran.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Shubham Chakraborty
94c938a0c1 staging: sm750fb: Rename sm750_pnltype enum values to upper case
Rename the sm750_pnltype enum values from mixed/CamelCase style to
upper-case names to follow kernel naming conventions for constants.

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Link: https://patch.msgid.link/20260407074805.14505-2-chakrabortyshubham66@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Hungyu Lin
d0856045f0 staging: sm750fb: constify fix_id array
Add the missing 'const' qualifier to the static fix_id array to ensure
the pointer array itself is immutable.

Originally:
    static const char *fix_id[2];
The strings are constant, but the pointer array itself is writable.

With the change:
    static const char * const fix_id[2];
Both the strings and the pointer array are immutable, allowing the
compiler to treat the object as read-only.

Verified by inspecting the generated object file with 'nm':

    00000000000002b8 0000000000000010 r fix_id.3

The 'r' flag indicates the symbol is placed in a read-only section.

This does not change runtime behavior as fix_id is never modified.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

Link: https://patch.msgid.link/20260401115024.89-1-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Gabriel Rondon
467716c1cc staging: most: video: remove redundant cleanup in comp_exit()
most_deregister_component() already calls disconnect_channel() for
every linked channel via bus_for_each_dev() in core.c, which invokes
comp_disconnect_channel() to remove each entry from the video_devices
list and tear down the V4L2 device.

The manual cleanup loop in comp_exit() duplicates this work and is
guarded by a stale comment claiming that "mostcore currently doesn't
call disconnect_channel() for linked channels" — but the core has
since been fixed to do exactly that.

Remove the redundant manual cleanup loop, the outdated comment, and
the BUG_ON() assertion that checked for a condition that can no longer
occur.

Signed-off-by: Gabriel Rondon <grondon@gmail.com>
Link: https://patch.msgid.link/20260412222318.65045-1-grondon@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Shyam Sunder Reddy Padira
57b5b1f450 staging: most: net: remove filename from top-of-file comment
Remove the filename reference from the
top-of-file comment block, to resolve a
checkpatch.pl warning. The filename comment is
not useful and can become outdated if the file is
renamed.

No functional changes.

Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com>
Link: https://patch.msgid.link/20260411095255.4890-1-shyamsunderreddypadira@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Hadi Chokr
62cf6eb023 staging: most/net: remove dead code from skb_to_mamac() and skb_to_mep()
The overflow checks in skb_to_mamac() and skb_to_mep() are always false:

  mdp_len = (skb->len - ETH_HLEN) + MDP_HDR_LEN = skb->len + 2
  mep_len = skb->len + MEP_HDR_LEN = skb->len + 8

Remove these checks to clean up the code.

Signed-off-by: Hadi Chokr <hadichokr@icloud.com>
Link: https://patch.msgid.link/20260401125711.80822-1-hadichokr@icloud.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Gabriel Rondon
fde67f5b1f staging: most: dim2: remove unnecessary NULL check in try_start_dim_transfer()
Remove the !hdm_ch check. Although hdm_ch is a function parameter,
it is already dereferenced on the preceding line to initialize
head (head = &hdm_ch->pending_list), so a NULL check after that
point is dead code.

Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/all/acwjEHyEYg0V3OyC@stanley.mountain
Signed-off-by: Gabriel Rondon <grondon@gmail.com>
Link: https://patch.msgid.link/20260401101038.24304-1-grondon@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Gabriel Rondon
6aa2b11ce5 staging: most: dim2: remove unnecessary NULL check in service_done_flag()
Remove the !hdm_ch check. hdm_ch is derived from dev->hch + ch_idx
(pointer arithmetic on a struct member), so it can never be NULL.
Keep only the !hdm_ch->is_initialized check.

Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/all/acuoL4DRi0pmsQY1@stanley.mountain
Signed-off-by: Gabriel Rondon <grondon@gmail.com>
Link: https://patch.msgid.link/20260331164443.47682-1-grondon@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27 05:01:51 -06:00
Ziran Zhang
13917f71a9 docs: isofs: replace dead ECMA-119 FTP link
The original link is no longer valid. Replace it with the official
PDF of the 2nd edition. The new link points to the exact 2nd edition
that the existing comment in isofs.rst refers to.

Signed-off-by: Ziran Zhang <zhangcoder@yeah.net>
Link: https://patch.msgid.link/20260425142943.6809-1-zhangcoder@yeah.net
Signed-off-by: Jan Kara <jack@suse.cz>
2026-04-27 12:58:07 +02:00
Catherine
7a5b81e0c8 wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.

That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.

Make res an automatic variable so each invocation keeps its own result.

Fixes: 3468e1e0c6 ("wifi: mac80211: add mesh fast-rx support")
Cc: stable@vger.kernel.org
Signed-off-by: Catherine <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260424131435.83212-2-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:41:55 +02:00
Michael Bommarito
9b55d5c1f5 wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path
__ieee80211_rx_handle_packet() resolves the link via
ieee80211_rx_data_set_link() on the pubsta->mlo path but ignores the
helper's return value.  Inside the helper,
  rx->link = rcu_dereference(rx->sdata->link[link_id]);
can leave rx->link NULL if link_id references a slot already cleared
by ieee80211_vif_set_links() during station-initiated ML
reconfiguration (see mlme.c's ieee80211_ml_reconfiguration(), which
invalidates sdata->link[] before the matching
ieee80211_sta_remove_link() loop walks the link-sta hash).  RX dispatch
still resolves a link_sta from the hash and then drops into
ieee80211_prepare_and_rx_handle(), which dereferences link->conf->addr.

Every other user site of ieee80211_rx_data_set_link() checks the return
and bails on failure; only this branch did not.  Mirror the safe
pattern.

Fixes: e66b7920aa ("wifi: mac80211: fix initialization of rx->link and rx->link_sta")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260422000651.4184602-1-michael.bommarito@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:41:33 +02:00
Michael Bommarito
381cd547bc wifi: nl80211: require admin perm on SET_PMK / DEL_PMK
NL80211_CMD_SET_PMK and NL80211_CMD_DEL_PMK manage the offloaded
4-way-handshake PMK state used by drivers advertising
NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X.  The only in-tree
driver that wires up both ->set_pmk / ->del_pmk and advertises
the feature today is brcmfmac, so the practical reach of this
patch is narrow.

Both ops were introduced without a .flags gate, so the generic
netlink layer dispatches them to an unprivileged caller instead
of rejecting with -EPERM at the permission check.  Every other
connection-state op in the adjacent block (CONNECT, ASSOCIATE,
AUTHENTICATE, SET_KEY, ...) carries GENL_UNS_ADMIN_PERM; SET_PMK
/ DEL_PMK were introduced without the flag in 2017 and left
unchanged by later refactors.  Johannes checked the original
Intel submission history and confirmed there is no admin check
in any prior revision either, so this seems likely to be a
simple oversight rather than an intentional carve-out.

Require GENL_UNS_ADMIN_PERM so the genl layer performs the same
capable(CAP_NET_ADMIN) check as its siblings.  wpa_supplicant
already needs CAP_NET_ADMIN for every other nl80211 op it issues,
so supplicant operation is unaffected.  The worst case the missing
gate enables today is an unprivileged local process on a
multi-user system invalidating the offloaded PMK state of another
user's 4-way-handshake session, forcing a full EAP re-auth on the
next reconnect.

Verified in UML: an unprivileged probe (uid=1000) sees
SET_MULTICAST_TO_UNICAST (sibling op with GENL_UNS_ADMIN_PERM)
return -EPERM on both pre- and post-fix kernels, while SET_PMK /
DEL_PMK return -ENODEV from nl80211_pre_doit()'s wdev lookup pre-
fix (proving dispatch crossed the genl permission check) and
-EPERM post-fix (rejected at the genl layer as intended).

Suggested-by: Johannes Berg <johannes@sipsolutions.net>
Fixes: 3a00df5707 ("cfg80211: support 4-way handshake offloading for 802.1X")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom>
Link: https://patch.msgid.link/20260421224552.4044147-1-michael.bommarito@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:40:54 +02:00
Amir Mohammad Jahangirzad
3994b4afd5 wifi: libertas: fix integer underflow in process_cmdrequest()
The existing validation only checks if recvlength exceeds
LBS_CMD_BUFFER_SIZE, but doesn't check the lower bound. When a
USB device sends a response shorter than MESSAGE_HEADER_LEN, the
subtraction (recvlength - MESSAGE_HEADER_LEN) wraps to a huge
value, causing memcpy to corrupt the heap.
Add the same lower bound check that libertas_tf already has.

Signed-off-by: Amir Mohammad Jahangirzad <a.jahangirzad@gmail.com>
Link: https://patch.msgid.link/20260418004247.368944-1-a.jahangirzad@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:40:32 +02:00
Tristan Madani
a035766f97 wifi: b43legacy: enforce bounds check on firmware key index in RX path
Same fix as b43: the firmware-controlled key index in b43legacy_rx()
can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is
non-enforcing in production builds, allowing an out-of-bounds read of
dev->key[].

Make the check enforcing by dropping the frame for invalid indices.

Fixes: 75388acd0c ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://patch.msgid.link/20260417111145.2694196-2-tristmd@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:39:57 +02:00
Tristan Madani
1f4f78bf85 wifi: b43: enforce bounds check on firmware key index in b43_rx()
The firmware-controlled key index in b43_rx() can exceed the dev->key[]
array size (58 entries). The existing B43_WARN_ON is non-enforcing in
production builds, allowing an out-of-bounds read.

Make the B43_WARN_ON check enforcing by dropping the frame when the
firmware returns an invalid key index.

Suggested-by: Jonas Gorski <jonas.gorski@gmail.com>
Acked-by: Michael Büsch <m@bues.ch>
Fixes: e4d6b79518 ("[B43]: add mac80211-based driver for modern BCM43xx devices")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://patch.msgid.link/20260417111145.2694196-1-tristmd@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:39:57 +02:00
Marek Szyprowski
c623b63580 wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
Watchdog task might end between send_sig() and kthread_stop() calls, what
results in the use-after-free issue. Fix this by increasing watchdog task
reference count before calling send_sig() and dropping it by switching to
kthread_stop_put().

Cc: stable@vger.kernel.org
Fixes: 373c83a801 ("brcmfmac: stop watchdog before detach and free everything")
Fixes: a9ffda88be ("brcm80211: fmac: abstract bus_stop interface function pointer")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260416093339.2066829-1-m.szyprowski@samsung.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:37:54 +02:00
Xueqin Luo
beec6b0a30
i2c: designware: Use PM_RUNTIME_ACQUIRE()/PM_RUNTIME_ACQUIRE_ERR()
Use new PM_RUNTIME_ACQUIRE() and PM_RUNTIME_ACQUIRE_ERR() wrapper macros
to make the code look more straightforward.

No intentional functional impact.

Signed-off-by: Xueqin Luo <luoxueqin@kylinos.cn>
Acked-by: Mika Westerberg <mika.westerberg@linx.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260417075451.5435-1-luoxueqin@kylinos.cn
2026-04-27 12:35:41 +02:00
Binbin Zhou
6d1b0785f6
i2c: ls2x-v2: Add driver for Loongson-2K0300 I2C controller
This I2C module is integrated into the Loongson-2K0300 SoCs.

It provides multi-master functionality and controls all I2C bus-specific
timing, protocols, arbitration, and timing. It supports both standard
and fast modes.

Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/c5a6c4e5ea675410ff1b946b988c280c22bf3dc4.1776135865.git.zhoubinbin@loongson.cn
2026-04-27 12:35:35 +02:00
Binbin Zhou
22623d6df6
dt-bindings: i2c: loongson,ls2x: Add ls2k0300-i2c compatible
Add "loongson,ls2k0300-i2c" dedicated compatible for representing I2C of
Loongson-2K0300 chip, because its HW integration is quiet different from
others.

Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/494e63efe2d129931402308c7c4d461454a30989.1776135865.git.zhoubinbin@loongson.cn
2026-04-27 12:35:25 +02:00
Quentin Schulz
ae653cb854 arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck
When not passing the PHY ID with an ethernet-phy-idX.Y compatible
property, the MDIO bus will attempt to auto-detect the PHY by reading
its registers and then probing the appropriate driver. For this to work,
the PHY needs to be in a working state.

Unfortunately, the net subsystem doesn't control the PHY reset GPIO when
attempting to auto-detect the PHY. This means the PHY needs to be in a
working state when entering the Linux kernel. This historically has been
the case for this device, but only because the bootloader was taking
care of initializing the Ethernet controller even when not using it.
We're attempting to support the removal of the network stack in the
bootloader, which means the Linux kernel will be entered with the PHY
still in reset and now Ethernet doesn't work anymore.

The devices in the field only ever had a TI DP83825, so let's simply
bypass the auto-detection mechanism entirely by passing the appropriate
PHY IDs via the compatible.

Note that this is only an issue since commit e463625af7 ("arm64: dts:
rockchip: move reset to dedicated eth-phy node on ringneck") as before
that commit the reset was done by the MAC controller before starting the
MDIO auto-detection mechanism, via the snps,reset-* properties.

Cc: stable@vger.kernel.org
Fixes: e463625af7 ("arm64: dts: rockchip: move reset to dedicated eth-phy node on ringneck")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260421-px30-eth-phy-v2-2-68c375b120fd@cherry.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-04-27 12:33:09 +02:00
Quentin Schulz
6598ed3586 arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Cobra
When not passing the PHY ID with an ethernet-phy-idX.Y compatible
property, the MDIO bus will attempt to auto-detect the PHY by reading
its registers and then probing the appropriate driver. For this to work,
the PHY needs to be in a working state.

Unfortunately, the net subsystem doesn't control the PHY reset GPIO when
attempting to auto-detect the PHY. This means the PHY needs to be in a
working state when entering the Linux kernel. This historically has been
the case for this device, but only because the bootloader was taking
care of initializing the Ethernet controller even when not using it.
We're attempting to support the removal of the network stack in the
bootloader, which means the Linux kernel will be entered with the PHY
still in reset and now Ethernet doesn't work anymore.

The devices in the field only ever had a TI DP83825, so let's simply
bypass the auto-detection mechanism entirely by passing the appropriate
PHY IDs via the compatible.

Fixes: bb510ddc9d ("arm64: dts: rockchip: add px30-cobra base dtsi and board variants")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260421-px30-eth-phy-v2-1-68c375b120fd@cherry.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-04-27 12:33:09 +02:00
Cristian Ciocaltea
b481c11cd2 arm64: dts: rockchip: Update vdec register blocks order on RK3588
With the introduction of the RK3588 SoC, three register blocks have been
provided for the video decoder unit instead of just one, which are
further referenced in the vendor's datasheet by 'link table', 'function'
and 'cache'.  The former is present at the top of the listing, starting
at video decoder unit base address, but the binding got this wrong
initially, i.e. the 'function' block got listed before the 'link' one.

Since the video decoder support for the aforementioned SoC in mainline
driver and devicetrees hasn't been released yet (just landed in
v7.0-rc1), address the problem by providing the register blocks for
vdec0 & vdec1 nodes using the 'link,function,cache' listing, which
ensures the unit address points to the primary register range.

This aligns with a similar fix for RK3576, where DTC also complained
about the bus address format.

Fixes: f61731bd60 ("arm64: dts: rockchip: Add the vdpu381 Video Decoders on RK3588")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://patch.msgid.link/20260304-vdec-reg-order-rk3576-v5-4-7006fad42c3a@collabora.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-04-27 12:29:14 +02:00
Cristian Ciocaltea
63fd2f6aa4 arm64: dts: rockchip: Fix vdec register blocks order on RK3576
When building device trees for the RK3576 based boards, DTC shows the
following complaint:

  rk3576.dtsi:1282.30-1304.5: Warning (simple_bus_reg): /soc/video-codec@27b00000: simple-bus unit address format error, expected "27b00100"

Since the video decoder support for the aforementioned SoC in mainline
driver and devicetrees hasn't been released yet (just landed in
v7.0-rc1), fix the issue by providing the register blocks using the
'link,function,cache' listing, which follows the address-based order as
shown in the vendor's datasheet and, implicitly, ensures the unit
address points to the primary register range.

Fixes: da0de806d8 ("arm64: dts: rockchip: Add the vdpu383 Video Decoder on rk3576")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://patch.msgid.link/20260304-vdec-reg-order-rk3576-v5-3-7006fad42c3a@collabora.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-04-27 12:29:14 +02:00
Randy Dunlap
713e899a68 docs: xforms_lists: allow __maybe_unused in func parameters
Bart has a patch (not yet merged) that causes kernel-doc warnings:

WARNING: ./include/linux/highmem.h:235 function parameter '__maybe_unused' not described in 'clear_user_pages'
Documentation/mm/highmem:211: ./include/linux/highmem.h:222: WARNING: Error in declarator or parameters

Handle this by adding "__maybe_unused" to the list of known function
parameter modifiers.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202604120025.jtlnpWff-lkp@intel.com/
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260411233526.3909303-1-rdunlap@infradead.org>
2026-04-27 04:07:06 -06:00
Hyeonjin Kim
8cfbcf36f9 docs: fix typos in kernel documentation
reinitalizes => reinitializes
unpriviledged => unprivileged
sub-struture => sub-structure

Signed-off-by: Hyeonjin Kim <fruitworld.planet@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260415001204.6428-1-fruitworld.planet@gmail.com>
2026-04-27 04:03:52 -06:00
Rio Liu
711a9c018a wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
Some Xfinity XB8 firmware advertises >1 spatial stream MCS indexes in
their basic HT-MCS set. On cards with lower spatial streams, the check
would fail, and we'd be stuck with no HT when in fact work fine with its
own supported rate. This change makes it so the check is only performed
in strict mode.

Fixes: 574faa0e93 ("wifi: mac80211: add HT and VHT basic set verification")
Signed-off-by: Rio Liu <rio@r26.me>
Link: https://patch.msgid.link/99Mv9QEceyPrQhSP52MtAVmz0_kWJmzqotJjD9YW6LGLqk-AZloAueUyHCURilFkuqOh6Ecv8i2KKdSE1ujP3AnbU5QEouVisT1w_V3xdfc=@r26.me
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-27 12:02:40 +02:00
Zhang Xiaolei
6df140b2b1 docs: staging: fix various typos and grammar issues
Fix a few typographical and grammatical issues across several
staging documentation files to improve readability:
- crc32.rst: replace "decide in" with "decide on"
- lzo.rst: replace "independent on" with "independent of"
- remoteproc.rst: fix word order in dependent clause
- static-keys.rst: add hyphen to "low-level"

Signed-off-by: Zhang Xiaolei <zxl434815272@gmail.com>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260416105854.788-1-zxl434815272@gmail.com>
2026-04-27 04:00:29 -06:00
Charlie Jenkins
49984b903a Documentation/binfmt-misc.rst: Specify aux vector for "O" flag description
Instead of replacing the file path in the argument vector, the file
descriptor is passed as AT_EXECFD in the auxilary vector. This appears
to have been the case at least since the git port, update the
documentation to reflect this.

Signed-off-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260418-binfmt_misc_doc_update-v1-1-c2e9601ab868@gmail.com>
2026-04-27 03:58:19 -06:00
Ninad Naik
1cf4830de2 Documentation: fix spelling mistake "stucture" -> "structure"
Fixing a spelling mistake in Documentation/trace/histogram-design.rst.

Signed-off-by: Ninad Naik <ninadnaik07@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260419184527.779828-1-ninadnaik07@gmail.com>
2026-04-27 03:56:14 -06:00
Baolin Liu
97a7bd8c2c Documentation: proc: fix section numbering in table of contents
Commit e24ccaaf7e ("block: remove last remaining traces of IDE
documentation") removed the IDE section but left its table of
contents entry behind.
Fix the stale entry and renumber the following sections.

Fixes: e24ccaaf7e ("block: remove last remaining traces of IDE documentation")
Signed-off-by: Baolin Liu <liubaolin@kylinos.cn>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260424090654.19229-1-liubaolin12138@163.com>
2026-04-27 03:54:05 -06:00
Marek Vasut
f924a4041f clk: renesas: r8a7740: Add ZT/ZTR trace clocks
Implement support for the ZT trace bus and ZTR trace clocks on R-Mobile
A1.

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260422233744.149872-3-marek.vasut+renesas@mailbox.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-04-27 11:52:42 +02:00