| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
I2C controllers may have child devices with GpioInt resources that
depend on GPIO controllers being fully initialized. If the I2C
controller probes and enumerates children before the referenced GPIO
controller has completed probe, GPIO interrupts may not be properly
configured, leading to device failures.
On Lenovo Yoga 7 14AGP11, the WACF2200 touchscreen (child of
AMDI0010:02) has a GpioInt resource pointing to GPIO 157 on the
pinctrl-amd controller (AMDI0030:00). When i2c-designware probes
AMDI0010:02 before pinctrl-amd finishes initializing, I2C transactions
fail with lost arbitration errors:
0.285952 amd_gpio_probe: registering gpiochip <- GPIO chip visible
0.287121 amd_gpio_probe: requesting parent IRQ <- probe still running
0.301454 AMDI0010:02 dw_i2c_plat_probe: start <- races here
2.348157 lost arbitration
Add a dependency check that walks ACPI child devices and defers probe
until any referenced GPIO controller is bound.
Fixes: 3812a9e84265 ("pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221494
Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Hardik Prakash <hardikprakash.official@gmail.com>
Assisted-by: Claude:claude-sonnet-5
Assisted-by: DeepSeek:deepseek-v4-pro
Cc: <stable@vger.kernel.org> # v7.1+
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260718054330.8975-2-hardikprakash.official@gmail.com
|
|
rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and
then reads the 802.11 frame control field without checking that a base
802.11 header remains.
The data path also pulls the calculated 802.11, QoS and SNAP header
span before confirming that the skb contains it. A truncated frame can
therefore cause out-of-bounds reads or leave insufficient data for the
Ethernet address writes.
Reject frames that do not contain the base 802.11 header and data
frames that do not contain their complete calculated header span.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Mariano Baragiola <mbaragiola@linux.com>
Link: https://patch.msgid.link/20260727160859.1917096-1-mbaragiola@linux.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The WEP shared-key authentication handler uses the challenge-text
element's attacker-controlled length without checking it against the
fixed 128-byte chg_txt buffer.
In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used
to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a
malicious AP sending a malformed WLAN_EID_CHALLENGE element can
overflow/underfill chg_txt by up to 127 bytes. It is reachable over the
air, before association, during shared-key authentication. In the case
of an overflow, the driver can write out of bounds. In the case of an
underfill, the driver can echo stale buffer memory.
The challenge text is defined to be exactly 128 octets, which is
already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the
element to be exactly that length before use.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com>
Link: https://patch.msgid.link/20260720082409.168379-1-npetrakopoulos2003@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
WMM_param_handler() copies a fixed-size WMM parameter element out of a
received information element without checking that the element is long
enough, causing an out-of-bounds read for a short WMM IE.
The handler reads sizeof(struct WMM_para_element) (18) bytes at
pIE->data + 6, so it requires pIE->length to be at least 24
(WLAN_WMM_LEN), but it never validates the length. Two of its three
callers reach it after matching only the WMM OUI: OnAssocRsp() in
rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a
4-byte OUI, before calling the handler. A vendor-specific IE carrying
the WMM OUI but a length between 6 and 23, placed in an association
response or in the IE blob handed to join_cmd_hdl(), passes the OUI
check and then makes the memcmp() and memcpy() at pIE->data + 6 read
past the end of the element. OnAssocRsp() parses a frame received from
the AP, so this is reachable from a remote peer.
The remaining caller in rtw_wlan_util.c already guards the handler with
"pIE->length == WLAN_WMM_LEN". Move the equivalent check into the
handler itself so every caller is covered; the sibling IE handlers in
the same parsing loop (HT_caps_handler(), HT_info_handler(),
ERP_IE_handler()) likewise bound their accesses by pIE->length.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260719041509.97894-1-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific
information element without checking that the element is long enough,
causing an out-of-bounds read for a short trailing IE.
The function locates a vendor-specific IE (EID 221) with rtw_get_ie()
and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte
version word at pbuf + 6. Those accesses require the IE body to be at
least 6 bytes, but rtw_get_ie() only guarantees that the element fits
within the buffer; it does not enforce a minimum body length. A
vendor-specific IE whose length byte is 0 to 5, placed at the end of
the buffer, therefore makes these reads run past the end of the IE and
past the end of the buffer itself.
The buffer holds information elements taken from received management
frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which
is kmemdup'd to its exact length, so the read can run off the end of
the allocation.
The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and
rtw_get_wps_ie() in this file already reject too-short vendor-specific
IEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in
line with them, and needs a minimum of 6 rather than 4 bytes because
of the version word. Add the missing length check.
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260719030631.88254-1-meatuni001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix the checkpatch.pl warning:
"WARNING: Missing a blank line after declarations"
in drv_types.h.
Add a blank line between the variable declaration and the subsequent
statement in RTW_ENABLE_FUNC() to comply with the kernel coding style.
Signed-off-by: Dang Vu Duc Hien <dvdh12707@gmail.com>
Link: https://patch.msgid.link/20260727195236.663392-1-dvdh12707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
These enumerations and their values are never used anywhere else; remove
them.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260727-rtl8723bs_rmove_enums-v1-1-7974aab6c86e@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The psta pointer was compared against NULL using an explicit equality
check. The kernel coding style prefers testing a pointer directly, so
use !psta instead. This also silences a checkpatch CHECK:
CHECK: Comparison to NULL could be written "!psta"
No functional change.
Signed-off-by: Arnesh Banerjee <linkrinku13@gmail.com>
Link: https://patch.msgid.link/20260726232119.6392-1-linkrinku13@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The custom RotR1 macro reuses its argument, which throws a checkpatch
warning and can lead to unexpected side-effects if called with an
expression that has side-effects.
Remove the custom macro and replace its usages with the standard
kernel ror16() function from <linux/bitops.h> to clean up the code.
Signed-off-by: Patryk Gawroński <gawronski1.6@gmail.com>
Link: https://patch.msgid.link/20260722215327.62791-1-gawronski1.6@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix a checkpatch warning by splitting multiple assignments on a single
line into separate operations. This improves code readability and aligns
with kernel coding style guidelines.
Signed-off-by: Patryk Gawroński <gawronski1.6@gmail.com>
Link: https://patch.msgid.link/20260722122618.41747-1-gawronski1.6@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Address checkpatch.pl warnings fixing reports of type LINE_SPACING:
WARNING: Missing a blank line after declarations
CHECK: Please don't use multiple blank lines
CHECK: Please use a blank line after function/struct/union/enum
declarations
Signed-off-by: Santiago Ruano Rincón <santiagorr@riseup.net>
Reviewed-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260723153526.255965-1-santiagorr@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove redundant goto statement and return _SUCCESS directly.
Signed-off-by: Leonardo Martins Martins <dev.lmmrtns@gmail.com>
Link: https://patch.msgid.link/20260721183746.80069-1-dev.lmmrtns@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Rename Restore_DM_Func_Flag to snake_case
format to comply with the Linux kernel coding style.
Signed-off-by: Olivier Tanoh <olivier.tanoh19@gmail.com>
Link: https://patch.msgid.link/20260720124544.63457-4-olivier.tanoh19@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Rename Save_DM_Func_Flag and Restore_DM_Func_Flag to snake_case
format to comply with the Linux kernel coding style.
Signed-off-by: Olivier Tanoh <olivier.tanoh19@gmail.com>
Link: https://patch.msgid.link/20260720124544.63457-3-olivier.tanoh19@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix checkpatch warning by wrapping the lines.
Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com>
Link: https://patch.msgid.link/20260719115451.4401-3-fliegbert2@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove unnecessary whitespace to improve readability and coding style
consistency.
No functional changes are intended in this patch.
Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com>
Link: https://patch.msgid.link/20260719115451.4401-2-fliegbert2@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix checkpatch.pl warnings by removing extra blank lines:
- after the license header, before the include guard
- inside the include guard, before the struct definition
- before the closing #endif
No functional change.
Signed-off-by: Som Tripathi <tripathisom142004@gmail.com>
Assisted-by: Claude:claude-sonnet-5
Link: https://patch.msgid.link/20260719075339.115500-1-somtri@iastate.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Collapse the static CamelCase helper function ReadChipVersion8723B()
directly into the main rtl8723b_read_chip_version() function.
This removes unnecessary code nesting and cleans up the CamelCase
naming violation in a single atomic change.
Signed-off-by: Arsenii Pashchenko <ulijg308@gmail.com>
Link: https://patch.msgid.link/20260718041431.9174-1-ulijg308@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
These fields are never set. They are never read from, since
GetHalDefVar() function never receives the neccessary constants.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-10-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The 'rf_chip' field is set to only one value (RF_6052), which makes any
conditions with this field predictable.
Remove it and the associated static functions (_ReadRFType() and
_InitRFType()), since they simply set a value in the field and will be
empty without it.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-9-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove the 'SdioTxFIFOFreePageLock' spinlock from the struct
hal_com_data, since the only operation performed on it is
initialization, while the locking and unlocking calls are commented out.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-8-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The value 'false' is written to this field but is not used.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-7-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
These values are read from the chip but never used.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-6-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The value 'true' is written to this field, but it is never used.
Remove it and the case branch, as the latter becomes meaningless. This
also requires removing calls to rtw_hal_set_hwreg() with the
'HW_VAR_DO_IQK' argument to prevent execution of the default branch
containing the netdev_dbg() call in SetHwReg().
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-5-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This field is always initialized to 'false' but is never used.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-4-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove the 'MCSTxPowerLevelOriginalOffset' array and the 'pwrGroupCnt'
field (which is used as an index for that array), as values are being
written to it but are no longer used.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-3-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Values are written to this array, but they are never used.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260717185407.56513-2-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
'linux/cdev.h' and 'linux/jiffies.h' are not used anywhere in this driver
it registers via miscdevices, not cdev, and there is no use of jiffies.
Signed-off-by: Shivank Sharma <shivanksharma2376543@gmail.com>
Link: https://patch.msgid.link/20260726051529.172905-1-shivanksharma2376543@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
`gb_audio_gb_get_topology()` combined three separate responsibilities into
a single call: querying the topology size, allocating a buffer for it, and
fetching the topology data into that buffer. This left callers with no
way to perform any of these steps independently, and forced the kzalloc()
allocation to live inside the protocol‑layer driver rather than the
caller, as already flagged by a FIXME comment at the call site
in `audio_module.c`.
Split the function into two:
- `gb_audio_gb_get_topology_size()` – queries only the topology size
- `gb_audio_gb_get_topology()` – fetches topology data into a
caller‑supplied buffer
of a given size
Update the only caller, `gb_audio_probe()` in `audio_module.c`, to
query the size first, allocate the topology buffer itself,
then fetch the data into it, freeing the buffer via the existing
`free_topology` error path on failure. The topology size is now
stored as `size_t` and validated in the caller before allocation,
addressing the earlier TODO and FIXME comments.
This resolves both the "TODO: Split into separate calls" comment
above the original function in `audio_gb.c` and the FIXME comment
at the call site in `audio_module.c`, both of which are removed
as part of this change.
No functional change in behavior for the existing probe path.
Signed-off-by: Aditya Chari S <adi25charis@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260725155108.7060-1-adi25charis@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The function sm750_enable_dma is defined in ddk750_power.c and declared
in ddk750_power.h, but it is not called anywhere in the driver.
Remove the unused definition and declaration.
This addresses the first task in the drivers/staging/sm750fb/TODO list:
"- refine the code and remove unused code".
Signed-off-by: Mohit Mishra <mishraloopmohit@gmail.com>
Link: https://patch.msgid.link/20260725090750.113598-2-mishraloopmohit@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The prototypes and kernel-doc comments for sm750_hw_copyarea() and
sm750_hw_imageblit() still use the old CamelCase parameter names,
while the function definitions in sm750_accel.c already use
snake_case. Rename the header parameters to match the definitions.
Fixes 10 checkpatch "Avoid CamelCase" checks. No functional change.
Signed-off-by: Gabriel Changamire <gaberashawn@gmail.com>
Link: https://patch.msgid.link/20260719064601.12223-1-gaberashawn@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Clean up minor formatting inconsistencies in sm750.h and sm750_accel.h:
- Remove a redundant consecutive blank line in sm750.h.
- Add missing spaces in comment blocks in sm750.h and sm750_accel.h.
- Align DE_SOURCE_X_K1_MONO_MASK macro definition in sm750_accel.h with
spaces instead of tabs to match surrounding macros.
Signed-off-by: Mohit Mishra <mishraloopmohit@gmail.com>
Link: https://patch.msgid.link/20260722175817.213235-2-mishraloopmohit@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The MOST core and the already converted net component log with device
context, while the video component still uses bare pr_err(), which
leaves its messages without any hint of the originating interface.
Both affected functions have the most_interface at hand, so log through
dev_err(iface->dev, ...) exactly like drivers/most/core.c does.
All English text in this patch (commit message and code comments) was
translated from a German draft with the assistance of Claude Fable 5.
Assisted-by: Claude:claude-fable-5 sparse
Signed-off-by: Nils Lehnen <nils.lehnen@proton.me>
Link: https://patch.msgid.link/20260718004223.54943-1-nils.lehnen@proton.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The set_stakey_parm struct contains a 16-byte encryption key.
Use kfree_sensitive() instead of kfree() to ensure the key
material is zeroed before the memory is freed, preventing
potential information leaks.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
Link: https://patch.msgid.link/20260717220135.17836-1-skunkolee@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix checkpatch warning by wrapping the lines.
Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com>
Link: https://patch.msgid.link/20260717161329.3400-3-fliegbert2@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Member name does not adhere to linux coding style.
Changed type as well since b indicates a boolean type and in every
instance of setting the variable the values true and false are used.
bDriverStopped -> driver_stopped
Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com>
Link: https://patch.msgid.link/20260717161329.3400-2-fliegbert2@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Reformat the multi-line function signature to a single line to fix
the following checkpatch.pl warning:
WARNING: function definition argument 'struct adapter *Adapter'
should also have an identifier name
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
Link: https://patch.msgid.link/20260717160328.8739-1-mokshpanicker.7@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
I changed the Update_RA_Entry() function to update_ra_entry()
to fix the camelcase warning by checkpatch, I updated every
instance it was present and I have checked it successfully
building the driver with the changes I have done.
Signed-off-by: Anirban Bose <boses156@gmail.com>
Link: https://patch.msgid.link/20260717140006.2443-1-boses156@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Reported style issue by checkpatch in the rtl8723bs driver.
changed the variable name to survey_para to adhere to Linux Kernel
coding style.
Signed-off-by: Max Raulea <max.raulea@gmail.com>
Link: https://patch.msgid.link/amhTbmQRr1MzBa6G@archlinux
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Correct a previous change (see Fixes) which reduced the standby timeout
from 30 to 5 seconds. Increase it to 15 seconds.
I was troubleshooting an error spotted during system suspend:
[ 1217.152867] ata1.00: Entering standby power mode
[ 1222.322948] ata1.00: qc timeout after 5000 msecs (cmd 0xe0)
[ 1222.324010] ata1.00: STANDBY IMMEDIATE failed (err_mask=0x4)
This drive is a Samsung 870 EVO SSD in good SMART standing, and I wasn't
aware of any reason it should be taking so long to standby. The issue is
intermittent, but I observed it sometimes taking 7 seconds to manually
standby. I assume this was interruption of background maintenance after
a power outage.
As a desktop user, I would prefer to wait the extra 2 seconds at suspend
to let the drive finish its business rather than drop the rails from
under it.
The change from 30 to 5 seconds was implicit when switching suspend
from START STOP UNIT to an internal command with no timeout table entry.
No reason was stated for the change.
Fixes: aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop")
Cc: stable@vger.kernel.org
Signed-off-by: Matt Vollrath <tactii@gmail.com>
Assisted-by: Claude:claude-5-fable
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
When a driver's .get_fec_stats() handler is called and the driver
supports FEC histogram stats, the driver supplies the histogram bin
ranges via a pointer. This pointer is assigned while under the netdev
ops lock in fec_prepare_data(), but the actual data is only read after
the lock is released; so this allows the driver to change the ranges
(e.g. from another .get_fec_stats() call) while the current call chain
is reading them in fec_fill_reply().
Fix this by adding an ethtool core-owned buffer, ranges_buf, to struct
ethtool_fec_hist. Drivers whose ranges are built dynamically (currently
just mlx5) fill ranges_buf and then point the existing ranges pointer at
it, giving ethtool a consistent copy that stays valid after the netdev
ops lock is dropped and later in fec_fill_reply(). Drivers whose ranges
are compile-time constants (bnxt, netdevsim) are unaffected by the
potential race and keep setting the existing ranges pointer to their
constant array, without making copies.
Fixes: cc2f08129925 ("ethtool: add FEC bins histogram report")
Signed-off-by: Eric Joyner <eric.joyner@amd.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20260723041342.39238-1-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
On every VF/SF vport enable, esw_acl_egress_ofld_setup() allocates an
egress ACL flow table and a fwd_grp whenever the device supports
egress_acl_forward_to_vport. The only consumer of that group is the
active/passive fwd2vport rule installed when two representor netdevs
are bonded - a path that almost never fires. As a result, hosts with
many VFs/SFs pay a per-vport flow table and flow group cost for a
feature most ports never use.
Defer the flow table and fwd_grp creation to the moment they are
actually needed, when mlx5e_rep_esw_bond_netevent() drives
mlx5_esw_acl_egress_vport_bond() for the passive vport:
- esw_acl_egress_ofld_setup() now returns early unless
prio_tag_required is set. When prio_tag_required is set the
flow table is still allocated eagerly for the VLAN pop rule, and
its size is grown by one when fwd2vport is supported so the lazy
fwd_grp can later be added without re-creating the table. Only
the VLAN group is built up-front.
- A new helper, esw_acl_egress_ofld_fwd2vport_setup(), allocates
the egress ACL flow table (size 1) and the fwd_grp on demand,
and rolls back the flow table if group creation fails and the
helper had just allocated it. Existing cleanup paths
(esw_acl_egress_ofld_cleanup() -> *_groups_destroy() /
*_table_destroy()) already tolerate NULL fields, so vport
disable continues to free everything that was actually
allocated.
- mlx5_esw_acl_egress_vport_bond() calls the helper for the
passive vport before installing the fwd2vport rule. The active
vport does not need the flow table on its own: with a NULL
fwd_dest, esw_acl_egress_ofld_rules_create() is a no-op unless
prio_tag_required is set, in which case the eager path already
built the table.
mlx5_esw_acl_egress_vport_bond() and mlx5_esw_acl_egress_vport_unbond()
now take esw->state_lock for the duration of the operation, because
they may mutate vport->egress.acl, which is also written by the vport
enable/disable path under the same lock.
Signed-off-by: Yael Chemla <ychemla@nvidia.com>
Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260723070427.1861502-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
mlx5e_shampo_update_ipv{4,6}_tcp_hdr() runs only from the
gro_count > 1 path in mlx5e_shampo_flush_skb(). HW-GRO flushes the
current session on a CWR packet and delivers it as a single-segment
skb via napi_gro_receive(), so the aggregated (gro_count > 1) skb
never carries a CWR-set TCP header.
This patch drops the unreachable branch. Discussion context:
https://lore.kernel.org/all/8b610e49-ff64-497e-8712-588b2228df02@nvidia.com/
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Cc: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260723072829.1864366-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The _once rate-limiting in slow_pci_heuristic() is unnecessary because
this function only runs during probe.
Worse, it interacts poorly with dynamic debug: if the first probe
happens before dynamic debug is enabled for this callsite, the _once
flag is permanently consumed and the message becomes unreachable without
reloading the module.
Additionally, only the first probed device values were printable in case
of multiple devices.
Replace with mlx5_core_dbg() which allows enabling the print via dynamic
debug at any time and observing it on the next probe.
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Alex Lazar <alazar@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260723081743.1868357-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
rpmsg client drivers are allowed to invoke rproc_report_crash() on their
grandparent when they determine that the otherwise seemingly healthy
remoteproc has entered a functionally broken state.
In the crash handling path qcom_q6v5_request_stop() is invoked, which is
based on the current rproc state whether to request a graceful shutdown.
But the current rproc `state` will be RPROC_CRASHED regardless of where
the crash handler was initiated from, and empirical data shows that
unless the firmware is taking part of the shutdown the system state is
often left such that it's not possible to start the subsystem again.
Use the `running` state in the q6v5 driver to make the decision instead,
as this does represent the actual state of the firmware.
This makes it possible to reliably trigger a restart from client
drivers.
Fixes: 3cc889eb83f5 ("remoteproc: qcom: q6v5: Avoid setting smem bit in case of crash shutdown")
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260723-q6v5-host-side-crash-v1-1-23bd53db90a7@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
|
|
Remove a stray leading space before __free_pages() call.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202607142323.qm25Crps-lkp@intel.com/
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
Link: https://patch.msgid.link/20260723094452.1888786-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
rproc_del() is subjected to the reference counted shutdown path, as such
a remoteproc with more than one reference will be left running as its
resources are released underneath it.
Refactor the shutdown path such that the reference count value is
ignored when called from rproc_del().
Assisted-by: OpenCode:GPT-5.5
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-3-546dfd5de0e6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
|
|
There's no synchronization between rproc_crash_handler_work() and
rproc_del(), as such it's possible for a driver to be removed while
crash-handler work is scheduled, or even executing - resulting in
use-after-free issues.
To avoid this the scheduled work need to be cancelled and synchronized
against before the removal proceeds.
In order to ensure that this doesn't race with the reporting, and
thereby scheduling new work, a "deleting" flag is introduced. This is
similar to the RPROC_DELETE state that was introduced to ensure that
"start" didn't race with rproc_del(), but the existing mechanism can not
be used as it's valid to call rproc_report_crash() in atomic context -
and the "state" is protected by a mutex.
In the event that work is cancelled the pm_stay_awake() is left
unbalanced and need to be unrolled.
The blocking and cancelling of crash-handler work prior to the actual
rproc_shutdown() call does have the explicit side-effect that crashes
resulting from the shutdown process will not enter the crash-handling
path, and as such will not generate devcoredumps etc. Due to the
existing mutual exclusion between these code paths there's no concrete
reduction in functionality, but further work would be needed to handle
this case.
Assisted-by: OpenCode:GPT-5.5
Fixes: 8afd519c3470 ("remoteproc: add rproc_report_crash function to notify rproc crashes")
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-2-546dfd5de0e6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
|
|
rproc_shutdown() rejects a remoteproc in RPROC_CRASHED state, and
rproc_del() ignores that error. The result of these two decisions is
that a user cannot stop a remoteproc that with recovery disabled that
has entered a crash state, and removal of an associated remoteproc
driver will release resources without first stopping the remoteproc.
Allow rproc_shutdown() to stop crashed processors. Propagate the crash
state to subdevice teardown, to allow subdevices to dismantle things
appropriately.
Assisted-by: OpenCode:GPT-5.5
Fixes: 5e6a0e05270e ("remoteproc: core: Move state checking to remoteproc_core")
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-1-546dfd5de0e6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
|
|
In rtase_start_xmit(), when the head buffer DMA mapping fails after
rtase_xmit_frags() has mapped all fragments, the error path clears
the fragment descriptors with rtase_tx_clear_range(), which frees
the skb through the last-frag slot and accounts tx_dropped. Control
then falls through to the common error label, which frees the same
skb a second time and counts it again.
Return right after clearing the fragments when the skb owns frags;
the no-frag case still drops through and frees the head skb once.
Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function")
Signed-off-by: Yun Lu <luyun@kylinos.cn>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Justin Lai <justinlai0215@realtek.com>
Link: https://patch.msgid.link/20260721023836.6691-1-luyun_611@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
