wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_netdev.patch
bluetooth-l2cap-initialize-delayed-works-at-l2cap_ch.patch
bluetooth-hci_sysfs-fix-attempting-to-call-device_ad.patch
-wifi-ath10k-reset-pointer-after-memory-free-to-avoid.patch
can-bcm-check-the-result-of-can_send-in-bcm_can_tx.patch
wifi-rt2x00-don-t-run-rt5592-iq-calibration-on-mt762.patch
wifi-rt2x00-set-correct-tx_sw_cfg1-mac-register-for-.patch
+++ /dev/null
-From 9b5822acd6054252d01ab94a16ec80d3081dc469 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Sep 2022 18:23:54 +0300
-Subject: wifi: ath10k: reset pointer after memory free to avoid potential
- use-after-free
-
-From: Wen Gong <quic_wgong@quicinc.com>
-
-[ Upstream commit 1e1cb8e0b73e6f39a9d4a7a15d940b1265387eb5 ]
-
-When running suspend test, kernel crash happened in ath10k, and it is
-fixed by commit b72a4aff947b ("ath10k: skip ath10k_halt during suspend
-for driver state RESTARTING").
-
-Currently the crash is fixed, but as a common code style, it is better
-to set the pointer to NULL after memory is free.
-
-This is to address the code style and it will avoid potential bug of
-use-after-free.
-
-Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
-Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220505092248.787-1-quic_wgong@quicinc.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath10k/htt_rx.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
-index 0a7551dc0f94..68728cba6df3 100644
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -302,12 +302,16 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
- ath10k_htt_get_vaddr_ring(htt),
- htt->rx_ring.base_paddr);
-
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
-+
- dma_free_coherent(htt->ar->dev,
- sizeof(*htt->rx_ring.alloc_idx.vaddr),
- htt->rx_ring.alloc_idx.vaddr,
- htt->rx_ring.alloc_idx.paddr);
-+ htt->rx_ring.alloc_idx.vaddr = NULL;
-
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- }
-
- static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
-@@ -641,8 +645,10 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
- ath10k_htt_get_rx_ring_size(htt),
- vaddr_ring,
- htt->rx_ring.base_paddr);
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
- err_dma_ring:
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- err_netbuf:
- return -ENOMEM;
- }
---
-2.35.1
-
regulator-core-prevent-integer-underflow.patch
bluetooth-l2cap-initialize-delayed-works-at-l2cap_ch.patch
bluetooth-hci_sysfs-fix-attempting-to-call-device_ad.patch
-wifi-ath10k-reset-pointer-after-memory-free-to-avoid.patch
can-bcm-check-the-result-of-can_send-in-bcm_can_tx.patch
wifi-rt2x00-don-t-run-rt5592-iq-calibration-on-mt762.patch
wifi-rt2x00-set-correct-tx_sw_cfg1-mac-register-for-.patch
+++ /dev/null
-From 2d2a66729c0f2e378145a56f79d5270ca79e4fbb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Sep 2022 18:23:54 +0300
-Subject: wifi: ath10k: reset pointer after memory free to avoid potential
- use-after-free
-
-From: Wen Gong <quic_wgong@quicinc.com>
-
-[ Upstream commit 1e1cb8e0b73e6f39a9d4a7a15d940b1265387eb5 ]
-
-When running suspend test, kernel crash happened in ath10k, and it is
-fixed by commit b72a4aff947b ("ath10k: skip ath10k_halt during suspend
-for driver state RESTARTING").
-
-Currently the crash is fixed, but as a common code style, it is better
-to set the pointer to NULL after memory is free.
-
-This is to address the code style and it will avoid potential bug of
-use-after-free.
-
-Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
-Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220505092248.787-1-quic_wgong@quicinc.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath10k/htt_rx.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
-index 28ec3c5b4d1f..1b34f12b7eca 100644
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -297,12 +297,16 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
- ath10k_htt_get_vaddr_ring(htt),
- htt->rx_ring.base_paddr);
-
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
-+
- dma_free_coherent(htt->ar->dev,
- sizeof(*htt->rx_ring.alloc_idx.vaddr),
- htt->rx_ring.alloc_idx.vaddr,
- htt->rx_ring.alloc_idx.paddr);
-+ htt->rx_ring.alloc_idx.vaddr = NULL;
-
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- }
-
- static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
-@@ -823,8 +827,10 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
- ath10k_htt_get_rx_ring_size(htt),
- vaddr_ring,
- htt->rx_ring.base_paddr);
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
- err_dma_ring:
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- err_netbuf:
- return -ENOMEM;
- }
---
-2.35.1
-
wifi-mt76-mt7921-reset-msta-airtime_ac-while-clearin.patch
bluetooth-l2cap-initialize-delayed-works-at-l2cap_ch.patch
bluetooth-hci_sysfs-fix-attempting-to-call-device_ad.patch
-wifi-ath10k-reset-pointer-after-memory-free-to-avoid.patch
can-bcm-check-the-result-of-can_send-in-bcm_can_tx.patch
wifi-rt2x00-don-t-run-rt5592-iq-calibration-on-mt762.patch
wifi-rt2x00-set-correct-tx_sw_cfg1-mac-register-for-.patch
+++ /dev/null
-From 5cefbba74a78f4f4a636a4ca1096c1b3a4549592 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Sep 2022 18:23:54 +0300
-Subject: wifi: ath10k: reset pointer after memory free to avoid potential
- use-after-free
-
-From: Wen Gong <quic_wgong@quicinc.com>
-
-[ Upstream commit 1e1cb8e0b73e6f39a9d4a7a15d940b1265387eb5 ]
-
-When running suspend test, kernel crash happened in ath10k, and it is
-fixed by commit b72a4aff947b ("ath10k: skip ath10k_halt during suspend
-for driver state RESTARTING").
-
-Currently the crash is fixed, but as a common code style, it is better
-to set the pointer to NULL after memory is free.
-
-This is to address the code style and it will avoid potential bug of
-use-after-free.
-
-Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
-Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220505092248.787-1-quic_wgong@quicinc.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath10k/htt_rx.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
-index adbaeb67eedf..9458540b7dde 100644
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -297,12 +297,16 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
- ath10k_htt_get_vaddr_ring(htt),
- htt->rx_ring.base_paddr);
-
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
-+
- dma_free_coherent(htt->ar->dev,
- sizeof(*htt->rx_ring.alloc_idx.vaddr),
- htt->rx_ring.alloc_idx.vaddr,
- htt->rx_ring.alloc_idx.paddr);
-+ htt->rx_ring.alloc_idx.vaddr = NULL;
-
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- }
-
- static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
-@@ -823,8 +827,10 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
- ath10k_htt_get_rx_ring_size(htt),
- vaddr_ring,
- htt->rx_ring.base_paddr);
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
- err_dma_ring:
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- err_netbuf:
- return -ENOMEM;
- }
---
-2.35.1
-
wifi-rtw89-fix-rx-filter-after-scan.patch
bluetooth-l2cap-initialize-delayed-works-at-l2cap_ch.patch
bluetooth-hci_sysfs-fix-attempting-to-call-device_ad.patch
-wifi-ath10k-reset-pointer-after-memory-free-to-avoid.patch
bnxt_en-replace-reset-with-config-timestamps.patch
selftests-bpf-free-the-allocated-resources-after-tes.patch
can-bcm-check-the-result-of-can_send-in-bcm_can_tx.patch
+++ /dev/null
-From 2ba0df8d117035d1b05d2db337b39e9c07b24cdc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Sep 2022 18:23:54 +0300
-Subject: wifi: ath10k: reset pointer after memory free to avoid potential
- use-after-free
-
-From: Wen Gong <quic_wgong@quicinc.com>
-
-[ Upstream commit 1e1cb8e0b73e6f39a9d4a7a15d940b1265387eb5 ]
-
-When running suspend test, kernel crash happened in ath10k, and it is
-fixed by commit b72a4aff947b ("ath10k: skip ath10k_halt during suspend
-for driver state RESTARTING").
-
-Currently the crash is fixed, but as a common code style, it is better
-to set the pointer to NULL after memory is free.
-
-This is to address the code style and it will avoid potential bug of
-use-after-free.
-
-Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
-Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220505092248.787-1-quic_wgong@quicinc.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath10k/htt_rx.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
-index fe34fcc00af0..55a520237263 100644
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -301,12 +301,16 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
- ath10k_htt_get_vaddr_ring(htt),
- htt->rx_ring.base_paddr);
-
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
-+
- dma_free_coherent(htt->ar->dev,
- sizeof(*htt->rx_ring.alloc_idx.vaddr),
- htt->rx_ring.alloc_idx.vaddr,
- htt->rx_ring.alloc_idx.paddr);
-+ htt->rx_ring.alloc_idx.vaddr = NULL;
-
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- }
-
- static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
-@@ -846,8 +850,10 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
- ath10k_htt_get_rx_ring_size(htt),
- vaddr_ring,
- htt->rx_ring.base_paddr);
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
- err_dma_ring:
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- err_netbuf:
- return -ENOMEM;
- }
---
-2.35.1
-
wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_netdev.patch
bluetooth-l2cap-initialize-delayed-works-at-l2cap_ch.patch
bluetooth-hci_sysfs-fix-attempting-to-call-device_ad.patch
-wifi-ath10k-reset-pointer-after-memory-free-to-avoid.patch
can-bcm-check-the-result-of-can_send-in-bcm_can_tx.patch
wifi-rt2x00-don-t-run-rt5592-iq-calibration-on-mt762.patch
wifi-rt2x00-set-correct-tx_sw_cfg1-mac-register-for-.patch
+++ /dev/null
-From 5d931348c7ad0a0465b1a1714152f675301bffe3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Sep 2022 18:23:54 +0300
-Subject: wifi: ath10k: reset pointer after memory free to avoid potential
- use-after-free
-
-From: Wen Gong <quic_wgong@quicinc.com>
-
-[ Upstream commit 1e1cb8e0b73e6f39a9d4a7a15d940b1265387eb5 ]
-
-When running suspend test, kernel crash happened in ath10k, and it is
-fixed by commit b72a4aff947b ("ath10k: skip ath10k_halt during suspend
-for driver state RESTARTING").
-
-Currently the crash is fixed, but as a common code style, it is better
-to set the pointer to NULL after memory is free.
-
-This is to address the code style and it will avoid potential bug of
-use-after-free.
-
-Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
-Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220505092248.787-1-quic_wgong@quicinc.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath10k/htt_rx.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
-index 760d24a28f39..f6fdb18f0950 100644
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -297,12 +297,16 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
- ath10k_htt_get_vaddr_ring(htt),
- htt->rx_ring.base_paddr);
-
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
-+
- dma_free_coherent(htt->ar->dev,
- sizeof(*htt->rx_ring.alloc_idx.vaddr),
- htt->rx_ring.alloc_idx.vaddr,
- htt->rx_ring.alloc_idx.paddr);
-+ htt->rx_ring.alloc_idx.vaddr = NULL;
-
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- }
-
- static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
-@@ -823,8 +827,10 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
- ath10k_htt_get_rx_ring_size(htt),
- vaddr_ring,
- htt->rx_ring.base_paddr);
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
- err_dma_ring:
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- err_netbuf:
- return -ENOMEM;
- }
---
-2.35.1
-
bluetooth-l2cap-initialize-delayed-works-at-l2cap_ch.patch
bluetooth-hci_sysfs-fix-attempting-to-call-device_ad.patch
bluetooth-hci_event-make-sure-iso-events-don-t-affec.patch
-wifi-ath10k-reset-pointer-after-memory-free-to-avoid.patch
bnxt_en-replace-reset-with-config-timestamps.patch
selftests-bpf-free-the-allocated-resources-after-tes.patch
can-bcm-check-the-result-of-can_send-in-bcm_can_tx.patch
+++ /dev/null
-From 3c40c49b26b3d3270cda809d326aa0b2a82eef63 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Sep 2022 18:23:54 +0300
-Subject: wifi: ath10k: reset pointer after memory free to avoid potential
- use-after-free
-
-From: Wen Gong <quic_wgong@quicinc.com>
-
-[ Upstream commit 1e1cb8e0b73e6f39a9d4a7a15d940b1265387eb5 ]
-
-When running suspend test, kernel crash happened in ath10k, and it is
-fixed by commit b72a4aff947b ("ath10k: skip ath10k_halt during suspend
-for driver state RESTARTING").
-
-Currently the crash is fixed, but as a common code style, it is better
-to set the pointer to NULL after memory is free.
-
-This is to address the code style and it will avoid potential bug of
-use-after-free.
-
-Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1
-Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
-Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
-Link: https://lore.kernel.org/r/20220505092248.787-1-quic_wgong@quicinc.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/ath/ath10k/htt_rx.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
-index 8a075a711b71..f84f6c4c2a7a 100644
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -301,12 +301,16 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
- ath10k_htt_get_vaddr_ring(htt),
- htt->rx_ring.base_paddr);
-
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
-+
- dma_free_coherent(htt->ar->dev,
- sizeof(*htt->rx_ring.alloc_idx.vaddr),
- htt->rx_ring.alloc_idx.vaddr,
- htt->rx_ring.alloc_idx.paddr);
-+ htt->rx_ring.alloc_idx.vaddr = NULL;
-
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- }
-
- static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
-@@ -846,8 +850,10 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
- ath10k_htt_get_rx_ring_size(htt),
- vaddr_ring,
- htt->rx_ring.base_paddr);
-+ ath10k_htt_config_paddrs_ring(htt, NULL);
- err_dma_ring:
- kfree(htt->rx_ring.netbufs_ring);
-+ htt->rx_ring.netbufs_ring = NULL;
- err_netbuf:
- return -ENOMEM;
- }
---
-2.35.1
-