The struct rtw_regulatory is never used in the rtl8723bs driver.
Functions taking it as a parameter are always passed NULL and
perform no logic with it. Remove the dead code and the struct.
Suggested-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Kenet Jovan Sokoli <deep@crimson.net.eu.org> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260414081325.142313-1-deep@crimson.net.eu.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8723bs: wrap long lines in rtl8723b_phycfg.c
Wrap lines that exceed the 100-column limit in rtl8723b_phycfg.c to
resolve checkpatch.pl warnings. Arguments are aligned with the open
parenthesis where appropriate to maintain readability.
Remove the unnecessary space between a type cast and the variable as
reported by checkpatch.pl. This improves code consistency and conforms
to the Linux kernel coding style.
staging: rtl8723bs: remove duplicate rate checks in PHY_GetTxPowerIndexBase()
The code previously checked (Rate >= MGN_MCS0 && Rate <= MGN_MCS7)
condition twice - once for the (BandWidth == CHANNEL_WIDTH_20) check and
once for the (BandWidth == CHANNEL_WIDTH_40) check. Fix if statement
formatting to move that if check as an outer if check to improve code
formatting.
staging: rtl8723bs: use read_poll_timeout_atomic in _is_fw_read_cmd_down
Replace the existing rtw_read8() and do-while loop mechanism with
read_poll_timeout_atomic() from <linux/iopoll.h>, in _is_fw_read_cmd_down()
which is a standard Linux macro, ensuring polling REG_HMETFR efficiently.
staging: rtl8723bs: simplify boolean return in IsFrameTypeCtrl()
Replace the simple if-else statement which checked value of
GetFrameType(pframe), if equal to WIFI_CTRL_TYPE, function
IsFrameTypeCtrl() returned true else false, with a single return
statement returning true only if GetFrameType(pframe) == WIFI_CTRL_TYPE
otherwise returns false.
staging: rtl8723bs: move constant to right side of test in comparison
Move constant from the left side to the right side of the test in a
comparison, where ==, !=, <=, >=, <, > operators are used, fixing the
checkpatch warning: Comparisons should place the constant on the right
side of the test.
Nikolay Kulikov [Tue, 7 Apr 2026 14:33:27 +0000 (17:33 +0300)]
staging: rtl8723bs: remove unused _rtw_init_queue() function header
The _rtw_init_queue() function header is declared in osdep_service.h,
but it is not defined anywhere and all the code using it is commented
out, so we can remove the header and the commented out code.
staging: rtl8723bs: remove two unused function prototypes
Removes two unused functions Rtw_Hal_ReadMACAddrFromFile and
Rtw_Hal_readPGDataFromConfigFile from rtw_efuse.h.
The functions only existed in this header. No implementation or calls
were present in the code.
staging: rtl8723bs: fix include guard comment in rtw_cmd.h
The #endif comment at the bottom of the file mistakenly referred to
_CMD_H_ instead of the actual include guard macro __RTW_CMD_H_ defined
at the top of the file.
The functions sm750_enable_i2c() and sm750_hw_cursor_set_data2() are
defined and declared but never used. Following the driver's TODO list
to remove unused code, this patch deletes these dead functions.
Hungyu Lin [Wed, 1 Apr 2026 11:50:24 +0000 (11:50 +0000)]
staging: sm750fb: constify fix_id array
Add the missing 'const' qualifier to the static fix_id array to ensure
the pointer array itself is immutable.
Originally:
static const char *fix_id[2];
The strings are constant, but the pointer array itself is writable.
With the change:
static const char * const fix_id[2];
Both the strings and the pointer array are immutable, allowing the
compiler to treat the object as read-only.
Verified by inspecting the generated object file with 'nm':
Gabriel Rondon [Sun, 12 Apr 2026 22:23:18 +0000 (23:23 +0100)]
staging: most: video: remove redundant cleanup in comp_exit()
most_deregister_component() already calls disconnect_channel() for
every linked channel via bus_for_each_dev() in core.c, which invokes
comp_disconnect_channel() to remove each entry from the video_devices
list and tear down the V4L2 device.
The manual cleanup loop in comp_exit() duplicates this work and is
guarded by a stale comment claiming that "mostcore currently doesn't
call disconnect_channel() for linked channels" — but the core has
since been fixed to do exactly that.
Remove the redundant manual cleanup loop, the outdated comment, and
the BUG_ON() assertion that checked for a condition that can no longer
occur.
staging: most: net: remove filename from top-of-file comment
Remove the filename reference from the
top-of-file comment block, to resolve a
checkpatch.pl warning. The filename comment is
not useful and can become outdated if the file is
renamed.
Gabriel Rondon [Wed, 1 Apr 2026 10:10:38 +0000 (11:10 +0100)]
staging: most: dim2: remove unnecessary NULL check in try_start_dim_transfer()
Remove the !hdm_ch check. Although hdm_ch is a function parameter,
it is already dereferenced on the preceding line to initialize
head (head = &hdm_ch->pending_list), so a NULL check after that
point is dead code.
Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/all/acwjEHyEYg0V3OyC@stanley.mountain Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260401101038.24304-1-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Gabriel Rondon [Tue, 31 Mar 2026 16:44:42 +0000 (17:44 +0100)]
staging: most: dim2: remove unnecessary NULL check in service_done_flag()
Remove the !hdm_ch check. hdm_ch is derived from dev->hch + ch_idx
(pointer arithmetic on a struct member), so it can never be NULL.
Keep only the !hdm_ch->is_initialized check.
Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/all/acuoL4DRi0pmsQY1@stanley.mountain Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260331164443.47682-1-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The original link is no longer valid. Replace it with the official
PDF of the 2nd edition. The new link points to the exact 2nd edition
that the existing comment in isofs.rst refers to.
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path
__ieee80211_rx_handle_packet() resolves the link via
ieee80211_rx_data_set_link() on the pubsta->mlo path but ignores the
helper's return value. Inside the helper,
rx->link = rcu_dereference(rx->sdata->link[link_id]);
can leave rx->link NULL if link_id references a slot already cleared
by ieee80211_vif_set_links() during station-initiated ML
reconfiguration (see mlme.c's ieee80211_ml_reconfiguration(), which
invalidates sdata->link[] before the matching
ieee80211_sta_remove_link() loop walks the link-sta hash). RX dispatch
still resolves a link_sta from the hash and then drops into
ieee80211_prepare_and_rx_handle(), which dereferences link->conf->addr.
Every other user site of ieee80211_rx_data_set_link() checks the return
and bails on failure; only this branch did not. Mirror the safe
pattern.
Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260422000651.4184602-1-michael.bommarito@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
wifi: nl80211: require admin perm on SET_PMK / DEL_PMK
NL80211_CMD_SET_PMK and NL80211_CMD_DEL_PMK manage the offloaded
4-way-handshake PMK state used by drivers advertising
NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X. The only in-tree
driver that wires up both ->set_pmk / ->del_pmk and advertises
the feature today is brcmfmac, so the practical reach of this
patch is narrow.
Both ops were introduced without a .flags gate, so the generic
netlink layer dispatches them to an unprivileged caller instead
of rejecting with -EPERM at the permission check. Every other
connection-state op in the adjacent block (CONNECT, ASSOCIATE,
AUTHENTICATE, SET_KEY, ...) carries GENL_UNS_ADMIN_PERM; SET_PMK
/ DEL_PMK were introduced without the flag in 2017 and left
unchanged by later refactors. Johannes checked the original
Intel submission history and confirmed there is no admin check
in any prior revision either, so this seems likely to be a
simple oversight rather than an intentional carve-out.
Require GENL_UNS_ADMIN_PERM so the genl layer performs the same
capable(CAP_NET_ADMIN) check as its siblings. wpa_supplicant
already needs CAP_NET_ADMIN for every other nl80211 op it issues,
so supplicant operation is unaffected. The worst case the missing
gate enables today is an unprivileged local process on a
multi-user system invalidating the offloaded PMK state of another
user's 4-way-handshake session, forcing a full EAP re-auth on the
next reconnect.
Verified in UML: an unprivileged probe (uid=1000) sees
SET_MULTICAST_TO_UNICAST (sibling op with GENL_UNS_ADMIN_PERM)
return -EPERM on both pre- and post-fix kernels, while SET_PMK /
DEL_PMK return -ENODEV from nl80211_pre_doit()'s wdev lookup pre-
fix (proving dispatch crossed the genl permission check) and
-EPERM post-fix (rejected at the genl layer as intended).
Suggested-by: Johannes Berg <johannes@sipsolutions.net> Fixes: 3a00df5707b6 ("cfg80211: support 4-way handshake offloading for 802.1X") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom> Link: https://patch.msgid.link/20260421224552.4044147-1-michael.bommarito@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
wifi: libertas: fix integer underflow in process_cmdrequest()
The existing validation only checks if recvlength exceeds
LBS_CMD_BUFFER_SIZE, but doesn't check the lower bound. When a
USB device sends a response shorter than MESSAGE_HEADER_LEN, the
subtraction (recvlength - MESSAGE_HEADER_LEN) wraps to a huge
value, causing memcpy to corrupt the heap.
Add the same lower bound check that libertas_tf already has.
wifi: b43legacy: enforce bounds check on firmware key index in RX path
Same fix as b43: the firmware-controlled key index in b43legacy_rx()
can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is
non-enforcing in production builds, allowing an out-of-bounds read of
dev->key[].
Make the check enforcing by dropping the frame for invalid indices.
wifi: b43: enforce bounds check on firmware key index in b43_rx()
The firmware-controlled key index in b43_rx() can exceed the dev->key[]
array size (58 entries). The existing B43_WARN_ON is non-enforcing in
production builds, allowing an out-of-bounds read.
Make the B43_WARN_ON check enforcing by dropping the frame when the
firmware returns an invalid key index.
Suggested-by: Jonas Gorski <jonas.gorski@gmail.com> Acked-by: Michael Büsch <m@bues.ch> Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Link: https://patch.msgid.link/20260417111145.2694196-1-tristmd@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Marek Szyprowski [Thu, 16 Apr 2026 09:33:39 +0000 (11:33 +0200)]
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
Watchdog task might end between send_sig() and kthread_stop() calls, what
results in the use-after-free issue. Fix this by increasing watchdog task
reference count before calling send_sig() and dropping it by switching to
kthread_stop_put().
Cc: stable@vger.kernel.org Fixes: 373c83a801f1 ("brcmfmac: stop watchdog before detach and free everything") Fixes: a9ffda88be74 ("brcm80211: fmac: abstract bus_stop interface function pointer") Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260416093339.2066829-1-m.szyprowski@samsung.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
i2c: ls2x-v2: Add driver for Loongson-2K0300 I2C controller
This I2C module is integrated into the Loongson-2K0300 SoCs.
It provides multi-master functionality and controls all I2C bus-specific
timing, protocols, arbitration, and timing. It supports both standard
and fast modes.
Add "loongson,ls2k0300-i2c" dedicated compatible for representing I2C of
Loongson-2K0300 chip, because its HW integration is quiet different from
others.
arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck
When not passing the PHY ID with an ethernet-phy-idX.Y compatible
property, the MDIO bus will attempt to auto-detect the PHY by reading
its registers and then probing the appropriate driver. For this to work,
the PHY needs to be in a working state.
Unfortunately, the net subsystem doesn't control the PHY reset GPIO when
attempting to auto-detect the PHY. This means the PHY needs to be in a
working state when entering the Linux kernel. This historically has been
the case for this device, but only because the bootloader was taking
care of initializing the Ethernet controller even when not using it.
We're attempting to support the removal of the network stack in the
bootloader, which means the Linux kernel will be entered with the PHY
still in reset and now Ethernet doesn't work anymore.
The devices in the field only ever had a TI DP83825, so let's simply
bypass the auto-detection mechanism entirely by passing the appropriate
PHY IDs via the compatible.
Note that this is only an issue since commit e463625af7f9 ("arm64: dts:
rockchip: move reset to dedicated eth-phy node on ringneck") as before
that commit the reset was done by the MAC controller before starting the
MDIO auto-detection mechanism, via the snps,reset-* properties.
arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Cobra
When not passing the PHY ID with an ethernet-phy-idX.Y compatible
property, the MDIO bus will attempt to auto-detect the PHY by reading
its registers and then probing the appropriate driver. For this to work,
the PHY needs to be in a working state.
Unfortunately, the net subsystem doesn't control the PHY reset GPIO when
attempting to auto-detect the PHY. This means the PHY needs to be in a
working state when entering the Linux kernel. This historically has been
the case for this device, but only because the bootloader was taking
care of initializing the Ethernet controller even when not using it.
We're attempting to support the removal of the network stack in the
bootloader, which means the Linux kernel will be entered with the PHY
still in reset and now Ethernet doesn't work anymore.
The devices in the field only ever had a TI DP83825, so let's simply
bypass the auto-detection mechanism entirely by passing the appropriate
PHY IDs via the compatible.
arm64: dts: rockchip: Update vdec register blocks order on RK3588
With the introduction of the RK3588 SoC, three register blocks have been
provided for the video decoder unit instead of just one, which are
further referenced in the vendor's datasheet by 'link table', 'function'
and 'cache'. The former is present at the top of the listing, starting
at video decoder unit base address, but the binding got this wrong
initially, i.e. the 'function' block got listed before the 'link' one.
Since the video decoder support for the aforementioned SoC in mainline
driver and devicetrees hasn't been released yet (just landed in
v7.0-rc1), address the problem by providing the register blocks for
vdec0 & vdec1 nodes using the 'link,function,cache' listing, which
ensures the unit address points to the primary register range.
This aligns with a similar fix for RK3576, where DTC also complained
about the bus address format.
arm64: dts: rockchip: Fix vdec register blocks order on RK3576
When building device trees for the RK3576 based boards, DTC shows the
following complaint:
rk3576.dtsi:1282.30-1304.5: Warning (simple_bus_reg): /soc/video-codec@27b00000: simple-bus unit address format error, expected "27b00100"
Since the video decoder support for the aforementioned SoC in mainline
driver and devicetrees hasn't been released yet (just landed in
v7.0-rc1), fix the issue by providing the register blocks using the
'link,function,cache' listing, which follows the address-based order as
shown in the vendor's datasheet and, implicitly, ensures the unit
address points to the primary register range.
Randy Dunlap [Sat, 11 Apr 2026 23:35:26 +0000 (16:35 -0700)]
docs: xforms_lists: allow __maybe_unused in func parameters
Bart has a patch (not yet merged) that causes kernel-doc warnings:
WARNING: ./include/linux/highmem.h:235 function parameter '__maybe_unused' not described in 'clear_user_pages'
Documentation/mm/highmem:211: ./include/linux/highmem.h:222: WARNING: Error in declarator or parameters
Handle this by adding "__maybe_unused" to the list of known function
parameter modifiers.
Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202604120025.jtlnpWff-lkp@intel.com/ Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260411233526.3909303-1-rdunlap@infradead.org>
Signed-off-by: Hyeonjin Kim <fruitworld.planet@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260415001204.6428-1-fruitworld.planet@gmail.com>
Rio Liu [Wed, 15 Apr 2026 16:57:13 +0000 (16:57 +0000)]
wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
Some Xfinity XB8 firmware advertises >1 spatial stream MCS indexes in
their basic HT-MCS set. On cards with lower spatial streams, the check
would fail, and we'd be stuck with no HT when in fact work fine with its
own supported rate. This change makes it so the check is only performed
in strict mode.
docs: staging: fix various typos and grammar issues
Fix a few typographical and grammatical issues across several
staging documentation files to improve readability:
- crc32.rst: replace "decide in" with "decide on"
- lzo.rst: replace "independent on" with "independent of"
- remoteproc.rst: fix word order in dependent clause
- static-keys.rst: add hyphen to "low-level"
Signed-off-by: Zhang Xiaolei <zxl434815272@gmail.com> Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260416105854.788-1-zxl434815272@gmail.com>
Charlie Jenkins [Sat, 18 Apr 2026 21:08:49 +0000 (17:08 -0400)]
Documentation/binfmt-misc.rst: Specify aux vector for "O" flag description
Instead of replacing the file path in the argument vector, the file
descriptor is passed as AT_EXECFD in the auxilary vector. This appears
to have been the case at least since the git port, update the
documentation to reflect this.
Signed-off-by: Charlie Jenkins <thecharlesjenkins@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260418-binfmt_misc_doc_update-v1-1-c2e9601ab868@gmail.com>
Baolin Liu [Fri, 24 Apr 2026 09:06:54 +0000 (17:06 +0800)]
Documentation: proc: fix section numbering in table of contents
Commit e24ccaaf7ec4 ("block: remove last remaining traces of IDE
documentation") removed the IDE section but left its table of
contents entry behind.
Fix the stale entry and renumber the following sections.
Fixes: e24ccaaf7ec4 ("block: remove last remaining traces of IDE documentation") Signed-off-by: Baolin Liu <liubaolin@kylinos.cn> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260424090654.19229-1-liubaolin12138@163.com>
Marek Vasut [Wed, 22 Apr 2026 23:36:27 +0000 (01:36 +0200)]
dt-bindings: clock: renesas,cpg-clocks: Document ZT/ZTR trace clock on R-Mobile A1
Document the ZT trace bus and ZTR trace clocks on R-Mobile A1. These
clocks supply the coresight tracing modules, PTM, TPIU, ETB and
replicator. Without these clocks, coresight tracing can not be
operated. While this does change the ABI, it does so by extending the
existing clock-output-names, therefore if old software is used with new
DT, the coresight tracing parts will likely fail to probe, otherwise if
new software is used with an old DT, there is no impact.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260422233744.149872-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have a MTU3
block connected to the PCLKH and with a module clock controlled by
register 0x308, bit 0.
Biju Das [Thu, 26 Mar 2026 11:06:38 +0000 (11:06 +0000)]
clk: renesas: r9a08g046: Add GBETH clocks and resets
Add clock and reset entries for the Gigabit Ethernet Interfaces (GBETH
0-1) IPs found on the RZ/G3L SoC. This includes various dividers and
mux clocks needed by these two GBETH IPs. Also add the tx, tx-180, rx,
rx-180, rmii, rmii-tx and rmii-rx clocks to the r9a08g046_no_pm_mod_clk
table to avoid enabling both normal and RMII clocks by the PM framework.
Biju Das [Thu, 26 Mar 2026 11:06:36 +0000 (11:06 +0000)]
clk: renesas: rzg2l: Add support for enabling PLLs
Add support for enabling PLL clocks in the RZ/G3L CPG driver to turn off
some PLLs, if they are not in use (e.g. PLL6, PLL7).
Introduce .is_enabled() and .enable() callbacks to handle PLL state
transitions. With the .enable() callback, the PLL will be turned ON
only when the PLL consumer device is enabled; otherwise, it will remain
off. Define new macros for PLL standby and monitor registers to
facilitate this process.
My Outlook email address often sends emails from kernel devs to the junk
folder. Also, emails from some addresses (eg suse.de) are not received
at all. Update the email to my alternate Proton Mail address.
Ravi Singh [Wed, 22 Apr 2026 07:39:59 +0000 (07:39 +0000)]
xfs: flush delalloc blocks on ENOSPC in xfs_trans_alloc_icreate
xfs_trans_alloc_icreate() can fail with ENOSPC when delalloc
reservations have consumed most of the available block count
(fdblocks). xfs_trans_alloc() already retries internally with
xfs_blockgc_flush_all(), but that only trims post-EOF speculative
preallocation and may not free enough space for the transaction
reservation.
Add a retry with xfs_flush_inodes() when xfs_trans_alloc() returns
ENOSPC. This forces writeback of all dirty inodes via
sync_inodes_sb(), converting delalloc reservations to real
allocations and freeing the over-reserved portion back to fdblocks.
This fixes all callers of xfs_trans_alloc_icreate() and removes
the existing caller-level retry from xfs_create(), which is now
handled centrally.
Signed-off-by: Ravi Singh <ravising@redhat.com> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
display_get_pci_dev_of() gets a referenced PCI device via
pci_get_device(). Drop that reference when pci_enable_device() fails and
release it during the managed teardown path after pci_disable_device().
Without that, ofdrm leaks the pci_dev reference on both the error path
and the normal cleanup path.
Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers") Co-developed-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Co-developed-by: Taegyu Kim <tmk5904@psu.edu> Signed-off-by: Taegyu Kim <tmk5904@psu.edu> Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260420002513.216-1-dbgh9129@gmail.com
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions
using plain integer division:
unsigned int width = mode_cmd->width / (i ? info->hsub : 1);
unsigned int height = mode_cmd->height / (i ? info->vsub : 1);
However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses
drm_format_info_plane_width/height() which round up dimensions via
DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object
size check for certain pixel format and dimension combinations.
For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the
GEM size validation path sees height=0 instead of height=1. The
expression (height - 1) then wraps to UINT_MAX as an unsigned int,
causing min_size to overflow and wrap back to a small value. A tiny
GEM object therefore passes the size guard, yet when the GPU accesses
the chroma plane it will read or write memory beyond the object's
bounds.
Fix by replacing the open-coded divisions with drm_format_info_plane_width()
and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match
the calculation already used in framebuffer_check().
projects / thirdparty / kernel / linux.git / log
