Convert sysfs show functions from sprintf() to sysfs_emit(), as
recommended by Documentation/filesystems/sysfs.rst. This ensures proper
buffer handling and avoids potential buffer overflows.
Signed-off-by: Stefan Pedratscher <pedratscher.stefan@gmail.com> Tested-by: Daniel Palmer <daniel@thingy.jp> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://patch.msgid.link/20260406172512.6693-1-pedratscher.stefan@gmail.com Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
The UAC3 cluster descriptor length check in
snd_usb_get_audioformat_uac3()was added to
make sure that the buffer is large enough for
a struct uac3_cluster_header_descriptor before the
returned data is cast and used.
However, the check uses sizeof(cluster), where cluster
is a pointer, not the size of the descriptor header.
This makes the validation depend on the architecture
pointer size and does not match the intended object size.
Cássio Gabriel [Fri, 24 Apr 2026 12:48:41 +0000 (09:48 -0300)]
ALSA: aloop: Fix peer runtime UAF during format-change stop
loopback_check_format() may stop the capture side when playback starts
with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved
the peer lookup under cable->lock, but the actual snd_pcm_stop() still
runs after dropping that lock.
A concurrent close can clear the capture entry from cable->streams[] and
detach or free its runtime while the playback trigger path still holds a
stale peer substream pointer.
Keep a per-cable count of in-flight peer stops before dropping
cable->lock, and make free_cable() wait for those stops before
detaching the runtime. This preserves the existing behavior while
making the peer runtime lifetime explicit.
Reported-by: syzbot+8fa95c41eafbc9d2ff6f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback") Cc: stable@vger.kernel.org Suggested-by: Takashi Iwai <tiwai@suse.com> Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260424-alsa-aloop-peer-stop-uaf-v2-1-94e68101db8a@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
Currently the runtime.oss.trigger field may be accessed concurrently
without protection, which may lead to the data race. And, in this
case, it may lead to more severe problem because it's a bit field; as
writing the data, it may overwrite other bit fields as well, which
confuses the operation completely, as spotted by fuzzing.
Fix it by covering runtime.oss.trigger bit fled also with the existing
params_lock mutex in both snd_pcm_oss_get_trigger() and
snd_pcm_oss_poll().
iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19
Due to CVE-2023-20585, the PPR log buffer must use the maximum supported
size (512K) on Genoa (Family 0x19, model >= 0x10) systems when SNP is
enabled, to mitigate a potential security vulnerability. Note that Family
0x19 models below 0x10 (Milan) do not support PPR when SNP is enabled.
Hence the PPR log size increase is only applied for model >= 0x10.
All other systems continue to use the default PPR log buffer size (8K).
Apply the errata fix by making the following changes:
- Introduce global new variable (amd_iommu_pprlog_size) to have PPR log buffer
size. Adjust variable size for Genoa family.
- Extend 'amd_iommu_apply_erratum_snp()' to also set the PPR log buffer
size to maximum for Family 0x19 model >= 0x10 when SNP is enabled.
iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19
Due to CVE-2023-20585, the Event log buffer must use the maximum supported
size (512K) on Milan/Genoa (Family 0x19) systems when SNP is enabled,
to mitigate a potential security vulnerability. All other systems continue to
use the default Event log buffer size (8K).
Apply the errata fix by making the following changes:
* Introduce new global variable (amd_iommu_evtlog_size) to have event log
buffer size. Adjust variable size for family 0x19.
* Since 'iommu_snp_enable()' must be called after the core IOMMU subsystem
is initialized, it cannot be moved to the early init stage. The SNP errata
must also be applied after the 'iommu_snp_enable()' check. Therefore,
'alloc_event_buffer()' and 'iommu_enable_event_buffer()' are now called
in the IOMMU_ENABLED state, after the errata is applied.
* Adjust alloc_event_buffer() and iommu_enable_event_buffer() to handle
all IOMMU instances.
* Also rename EVT_* macros to make it more readable.
Cássio Gabriel [Thu, 23 Apr 2026 13:11:31 +0000 (10:11 -0300)]
ALSA: hda: cs35l56: Propagate ASP TX source control errors
cs35l56_hda_mixer_get() ignores regmap_read() and
cs35l56_hda_mixer_put() ignores regmap_update_bits_check().
This makes the ASP TX source controls report success when a regmap
access fails. The write path returns no change instead of an error,
and the read path continues after a failed read instead of aborting
the control callback.
Propagate the regmap errors, matching the posture and volume controls
in this driver.
Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260423-alsa-cs35l56-asp-tx-source-errors-v1-1-17ea7c62ec31@gmail.com
Cássio Gabriel [Sun, 19 Apr 2026 20:30:32 +0000 (17:30 -0300)]
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
snd_us16x08_comp_put() and snd_us16x08_eq_put() update their
software stores before sending the USB write. If the transfer
fails, later get callbacks report a value the hardware never
accepted.
Build the outgoing message from the current store plus the
pending value, then commit the store only after a successful
write.
Cássio Gabriel [Sun, 19 Apr 2026 20:30:31 +0000 (17:30 -0300)]
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
Several US-16x08 mixer put callbacks log failed control URBs but
still return success to userspace. That hides device write failures
even though the requested value was not applied.
Return the negative write error instead in the route, master, bus,
channel, and EQ switch put callbacks.
Cássio Gabriel [Sun, 19 Apr 2026 20:30:30 +0000 (17:30 -0300)]
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
scarlett_ctl_enum_put() ignores the return value from
snd_usb_set_cur_mix_value() and reports success whenever the
requested enum value differs from the current one.
If the SET_CUR request fails, the callback still returns success even
though neither the hardware state nor the cached mixer value changed.
Cássio Gabriel [Sun, 19 Apr 2026 20:30:29 +0000 (17:30 -0300)]
ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
mixer_ctl_feature_put(), mixer_ctl_procunit_put(), and
mixer_ctl_selector_put() ignore failures from their SET_CUR helper
routines and report the control as changed whenever the requested
value differs from the current one.
If the device rejects the write, userspace still sees success although
the hardware state did not change. Propagate write failures instead,
using filter_error() so ignore_ctl_error keeps the same semantics as
the existing get paths.
Cássio Gabriel [Mon, 13 Apr 2026 19:45:34 +0000 (16:45 -0300)]
ALSA: opti9xx: restore snd-miro state after resume
snd-miro has no PM callbacks, so system resume leaves the OPTi
master-control registers and the board-specific ACI mixer state
unrestored.
Like snd-opti9xx, the driver needs to reprogram the OPTi routing
registers before bringing the codec back. snd-miro also keeps mixer
state in the ACI block, so the codec resume callback alone is not
enough here. Save the ACI mixer state on suspend, reinitialize the
OPTi and ACI state on resume, replay the saved ACI values, and then
resume the WSS codec. Hook the PM handlers into both the ISA and PnP
paths.
Also initialize miro->card on the ISA path for the existing dev_*()
logging and keep the cached solo-mode value aligned with the value
written to hardware.
PCM20 radio tuner state remains outside this driver's PM scope.
Add the RK3588_SYSGRF_SOC_CON6 register offset to the RK3588 GRF
header. This register contains the I2S MCLK output to IO gate bits,
needed by the clock driver.
clk: rockchip: add helper to register auxiliary GRFs
Add rockchip_clk_add_grf() as a helper to register an auxiliary GRF
into the clock provider's aux_grf_table. This encapsulates the
struct rockchip_aux_grf allocation and hashtable insertion, so SoC
clock drivers do not need to open-code it.
clk: rockchip: allow grf_type_sys lookup in aux_grf_table
Remove the grf_type_sys exclusion from the auxiliary GRF table lookup
in rockchip_clk_register_branches(). Previously, branches with
grf_type_sys always used ctx->grf directly, bypassing the aux_grf_table.
This is a problem on SoCs like RK3588 where ctx->grf points to the
PHP_GRF (set via the CRU's rockchip,grf phandle), but GATE_GRF clock
entries need to access the SYS_GRF instead.
With this change, grf_type_sys branches first check the aux_grf_table,
and fall back to ctx->grf if no entry is found. This is backwards
compatible: on SoCs that do not register grf_type_sys in the
aux_grf_table, the behavior is unchanged.
Add clock identifiers for the four I2S MCLK output to IO gate clocks
on RK3588, needed by board DTS files where the codec requires MCLK
from the SoC on an external IO pin.
ima: return error early if file xattr cannot be changed
During early boot, the filesystem is read-only and any changes
to xattrs are not allowed. This fails in case of ext4 because
changing xattr starts an ext4 transaction which fails with the
following warning.
ima: Fix sigv3 signature handling for EVM_IMA_XATTR_DIGSIG
ima_get_hash_algo() only recognizes version 2 signatures when the xattr
type is EVM_IMA_XATTR_DIGSIG. Since sigv3 signatures also use
EVM_IMA_XATTR_DIGSIG as the xattr type, version 3 must be accepted as
well to correctly determine the hash algorithm.
Additionally, ima_validate_rule() does not include IMA_SIGV3_REQUIRED in
the allowed flags bitmask for MODULE_CHECK, KEXEC_KERNEL_CHECK, and
KEXEC_INITRAMFS_CHECK hook functions. As a result, policy rules with
"appraise_type=sigv3" are rejected for these functions.
Add version 3 to the accepted versions in ima_get_hash_algo() for
EVM_IMA_XATTR_DIGSIG, and add IMA_SIGV3_REQUIRED to the allowed flags
for MODULE_CHECK, KEXEC_KERNEL_CHECK, and KEXEC_INITRAMFS_CHECK in
ima_validate_rule().
Signed-off-by: Kamlesh Kumar <kam@juniper.net> Tested-by: Stefan Berger <stefanb@linux.ibm.com> Fixes: de4c44a7f559 ("ima: add support to require IMA sigv3 signatures") Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
According to the NanoPi R5S 2204 schematic on page 6, GPIO0_C4 is for
GMAC0_INT/PMEB_GPIO0_C4, while GPIO0_C5 is for GMAC0_RSTn_GPIO0_C5.
While the 'reset-gpios' property was set correctly, the corresponding
pinctrl didn't match that.
Next to fixing the pinctrl definition, also change the node name and
phandle to match what is used in the schematic.
Peter Chen [Tue, 21 Apr 2026 02:34:59 +0000 (10:34 +0800)]
usb: cdns3: Add USBSSP platform driver support
Expose Cadence USBSSP through the same platform path as USBSS, trim
Kconfig and Makefile: one core loadable object plus separate glue .ko
files.
Single cdns.ko bundles core, DRD, the generic "cdns,usb3" platform
driver in cdns3-plat.c, optional host.o, and optional gadget objects.
Use CONFIG_USB_CDNS3_GADGET as a bool to compile gadget support into
that module. Remove duplicate MODULE_* declarations from cdns3-plat.c
now that it links into the same module.
Kconfig: the generic platform driver is selected via CONFIG_USB_CDNS3.
Move CONFIG_USB_CDNSP_PCI beside CONFIG_USB_CDNS3_PCI_WRAP under
"Platform glue driver support". SoC glue entries (TI, i.MX, StarFive)
depend only on CONFIG_USB_CDNS3.
Tighten CONFIG_USB_CDNS_SUPPORT dependencies so the umbrella follows
host or gadget when either is built as a module. Match host and gadget
bools to the cdns.ko tristate with USB=USB_CDNS3 and USB_GADGET=USB_CDNS3
instead of comparing against USB_CDNS_SUPPORT.
Link host.o when CONFIG_USB_CDNS3_HOST is enabled and use that symbol in
host-export.h, removing the redundant CONFIG_USB_CDNS_HOST indirection.
Export cdns_core_init_role and reorganize the function cdns_init, and
controller version could be gotten before the gadget init function is
decided per controller.
Keep host_init / gadget_init callbacks in struct cdns, so core.c does
not need direct linkage to host or gadget objects. Refactor cdnsp-pci.c
into a thin PCI-to-platform wrapper.
drivers/usb/Makefile: descend into drivers/usb/cdns3/ only when
CONFIG_USB_CDNS_SUPPORT is enabled.
Peter Chen [Tue, 21 Apr 2026 02:34:58 +0000 (10:34 +0800)]
dt-bindings: usb: cdns,usb3: document USBSSP controller support
Update the Cadence USBSS DRD binding to document that it also covers
the USBSSP (SuperSpeed Plus, USB 3.1 gen2x1) controller. Both USBSS
and USBSSP share the same DRD/OTG register interface, so the driver
auto-detects the controller version at runtime: no additional
compatible string is needed.
Changes to the binding:
- Update title and add description
- maximum-speed: add super-speed-plus
Xu Yang [Thu, 23 Apr 2026 09:53:55 +0000 (17:53 +0800)]
usb: gadget: udc: skip pullup() if already connected
The device controller may update vbus status via usb_udc_vbus_handler(),
which tries to connect the gadget even though gadget_bind_driver() has
already called usb_udc_connect_control_locked(). This causes pullup() to
be called twice. Avoid this by checking if gadget->connected is true.
This also set gadget->connected as false in usb_gadget_activate() if it
became connected while it was being deactivated. Otherwise,
usb_gadget_connect_locked will return early and pullup() won't be called.
The Cadence CDNSP controller optionally supports eUSB2 (embedded USB2)
port. While this port type operates logically like high-speed USB 2.0,
it utilizes a different physical layer signaling.
This patch:
- Extends the port detection logic to recognize the eUSB2 protocol.
- Tracks the eUSB2 port offset in the cdnsp_device structure.
- Ensures that eUSB2 ports are correctly handled during Link State
transitions, specifically forcing L0 when LPM is capable, similar
to standard USB 2.0 ports.
staging: rtl8723bs: remove unused offset in phase 2 _BlockWrite()
Commit c1314fe4d28f ("staging: rtl8723bs: remove all RT_TRACE logs
in hal/ and os_dep/") removed the unnecessary RT_TRACE logs in hal/
and os_dep/ files, but left the variable "offset" in the Phase 2
_BlockWrite() function unused, so delete it.
This is reported by Coverity Scan with CID 1408950 as UNUSED_VALUE.
Signed-off-by: Robertus Diawan Chris <robertusdchris@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com> Link: https://patch.msgid.link/20260420044651.164450-1-robertusdchris@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Nikolay Kulikov [Sun, 19 Apr 2026 07:19:36 +0000 (10:19 +0300)]
staging: rtl8723bs: rename EnableInterrupt8723BSdio() to snake_case
Rename function EnableInterrupt8723BSdio() to
rtw_sdio_enable_interrupt() and format its description to comply with
Linux kernel coding style.
Declare this function without 'extern' prototype in the .h file to fix
checkpatch.pl warning.
Remove rtw_hal_read_chip_version() function, as it's just a wrapper
that calls rtl8723b_read_chip_version() directly. Replace all its calls
to the rtl8723b_read_chip_version(). This will remove an extra level of
abstraction and simplify the code.
Remove the rtw_hal_read_chip_info() function, as it's just a wrapper
that calls ReadAdapterInfo8723BS() directly. Replace all its calls to
the ReadAdapterInfo8723BS() function. This will remove an extra level of
abstraction and simplify the code.
Remove the rtw_hal_chip_configure() function, as it's just a wrapper
that calls rtl8723bs_interface_configure() directly. Instead, call
rtl8723bs_interface_configure() from the appropriate places. This will
reduce code complexity and improve readability by removing unnecessary
abstraction.
Mahad Ibrahim [Sun, 12 Apr 2026 14:45:52 +0000 (10:45 -0400)]
staging: fbtft: Use %pe format specifier for error pointers
The %pe format specifier resolves error pointers to their symbolic
representation. Previously %ld with PTR_ERR() was being used, %pe is a
better alternative.
Fixes the following coccinelle warnings reported by coccicheck:
WARNING: Consider using %pe to print PTR_ERR()
Testing: I do not own the hardware, therefore I could not perform
hardware testing. Compile tested only.
Nikolay Kulikov [Tue, 21 Apr 2026 05:15:15 +0000 (08:15 +0300)]
staging: rtl8723bs: remove dump_chip_info() function
The dump_chip_info() function formats chip version information into a
local 128-byte buffer using the scnprintf(). This buffer was previously
passed to the DBG_871X macro.
Commit 968b15adb0ea ("staging: rtl8723bs: remove all DBG_871X logs")
removed the macro, leaving the buffer formatted but never used or output
anywhere.
dump_chip_info() is now useless, so remove it and its call from
ReadChipVersion8723B().
Luka Gejak [Wed, 15 Apr 2026 08:56:38 +0000 (10:56 +0200)]
staging: rtl8723bs: clean up memcpy() in rtw_check_bcn_info
Move the ssid memcpy() inside the ie null-check to avoid calling it
with a NULL-derived pointer (p + 2) when the ie is missing.
While the kernel handles 0-length memcpy() safely as a no-op, keeping
the call outside the check is confusing and poor practice. This
change improves code readability.
The struct rtw_regulatory is never used in the rtl8723bs driver.
Functions taking it as a parameter are always passed NULL and
perform no logic with it. Remove the dead code and the struct.
Suggested-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Kenet Jovan Sokoli <deep@crimson.net.eu.org> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260414081325.142313-1-deep@crimson.net.eu.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8723bs: wrap long lines in rtl8723b_phycfg.c
Wrap lines that exceed the 100-column limit in rtl8723b_phycfg.c to
resolve checkpatch.pl warnings. Arguments are aligned with the open
parenthesis where appropriate to maintain readability.
Remove the unnecessary space between a type cast and the variable as
reported by checkpatch.pl. This improves code consistency and conforms
to the Linux kernel coding style.
staging: rtl8723bs: remove duplicate rate checks in PHY_GetTxPowerIndexBase()
The code previously checked (Rate >= MGN_MCS0 && Rate <= MGN_MCS7)
condition twice - once for the (BandWidth == CHANNEL_WIDTH_20) check and
once for the (BandWidth == CHANNEL_WIDTH_40) check. Fix if statement
formatting to move that if check as an outer if check to improve code
formatting.
staging: rtl8723bs: use read_poll_timeout_atomic in _is_fw_read_cmd_down
Replace the existing rtw_read8() and do-while loop mechanism with
read_poll_timeout_atomic() from <linux/iopoll.h>, in _is_fw_read_cmd_down()
which is a standard Linux macro, ensuring polling REG_HMETFR efficiently.
staging: rtl8723bs: simplify boolean return in IsFrameTypeCtrl()
Replace the simple if-else statement which checked value of
GetFrameType(pframe), if equal to WIFI_CTRL_TYPE, function
IsFrameTypeCtrl() returned true else false, with a single return
statement returning true only if GetFrameType(pframe) == WIFI_CTRL_TYPE
otherwise returns false.
staging: rtl8723bs: move constant to right side of test in comparison
Move constant from the left side to the right side of the test in a
comparison, where ==, !=, <=, >=, <, > operators are used, fixing the
checkpatch warning: Comparisons should place the constant on the right
side of the test.
Nikolay Kulikov [Tue, 7 Apr 2026 14:33:27 +0000 (17:33 +0300)]
staging: rtl8723bs: remove unused _rtw_init_queue() function header
The _rtw_init_queue() function header is declared in osdep_service.h,
but it is not defined anywhere and all the code using it is commented
out, so we can remove the header and the commented out code.
staging: rtl8723bs: remove two unused function prototypes
Removes two unused functions Rtw_Hal_ReadMACAddrFromFile and
Rtw_Hal_readPGDataFromConfigFile from rtw_efuse.h.
The functions only existed in this header. No implementation or calls
were present in the code.
staging: rtl8723bs: fix include guard comment in rtw_cmd.h
The #endif comment at the bottom of the file mistakenly referred to
_CMD_H_ instead of the actual include guard macro __RTW_CMD_H_ defined
at the top of the file.
The functions sm750_enable_i2c() and sm750_hw_cursor_set_data2() are
defined and declared but never used. Following the driver's TODO list
to remove unused code, this patch deletes these dead functions.
Hungyu Lin [Wed, 1 Apr 2026 11:50:24 +0000 (11:50 +0000)]
staging: sm750fb: constify fix_id array
Add the missing 'const' qualifier to the static fix_id array to ensure
the pointer array itself is immutable.
Originally:
static const char *fix_id[2];
The strings are constant, but the pointer array itself is writable.
With the change:
static const char * const fix_id[2];
Both the strings and the pointer array are immutable, allowing the
compiler to treat the object as read-only.
Verified by inspecting the generated object file with 'nm':
Gabriel Rondon [Sun, 12 Apr 2026 22:23:18 +0000 (23:23 +0100)]
staging: most: video: remove redundant cleanup in comp_exit()
most_deregister_component() already calls disconnect_channel() for
every linked channel via bus_for_each_dev() in core.c, which invokes
comp_disconnect_channel() to remove each entry from the video_devices
list and tear down the V4L2 device.
The manual cleanup loop in comp_exit() duplicates this work and is
guarded by a stale comment claiming that "mostcore currently doesn't
call disconnect_channel() for linked channels" — but the core has
since been fixed to do exactly that.
Remove the redundant manual cleanup loop, the outdated comment, and
the BUG_ON() assertion that checked for a condition that can no longer
occur.
staging: most: net: remove filename from top-of-file comment
Remove the filename reference from the
top-of-file comment block, to resolve a
checkpatch.pl warning. The filename comment is
not useful and can become outdated if the file is
renamed.
Gabriel Rondon [Wed, 1 Apr 2026 10:10:38 +0000 (11:10 +0100)]
staging: most: dim2: remove unnecessary NULL check in try_start_dim_transfer()
Remove the !hdm_ch check. Although hdm_ch is a function parameter,
it is already dereferenced on the preceding line to initialize
head (head = &hdm_ch->pending_list), so a NULL check after that
point is dead code.
Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/all/acwjEHyEYg0V3OyC@stanley.mountain Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260401101038.24304-1-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Gabriel Rondon [Tue, 31 Mar 2026 16:44:42 +0000 (17:44 +0100)]
staging: most: dim2: remove unnecessary NULL check in service_done_flag()
Remove the !hdm_ch check. hdm_ch is derived from dev->hch + ch_idx
(pointer arithmetic on a struct member), so it can never be NULL.
Keep only the !hdm_ch->is_initialized check.
Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/all/acuoL4DRi0pmsQY1@stanley.mountain Signed-off-by: Gabriel Rondon <grondon@gmail.com> Link: https://patch.msgid.link/20260331164443.47682-1-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The original link is no longer valid. Replace it with the official
PDF of the 2nd edition. The new link points to the exact 2nd edition
that the existing comment in isofs.rst refers to.
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path
__ieee80211_rx_handle_packet() resolves the link via
ieee80211_rx_data_set_link() on the pubsta->mlo path but ignores the
helper's return value. Inside the helper,
rx->link = rcu_dereference(rx->sdata->link[link_id]);
can leave rx->link NULL if link_id references a slot already cleared
by ieee80211_vif_set_links() during station-initiated ML
reconfiguration (see mlme.c's ieee80211_ml_reconfiguration(), which
invalidates sdata->link[] before the matching
ieee80211_sta_remove_link() loop walks the link-sta hash). RX dispatch
still resolves a link_sta from the hash and then drops into
ieee80211_prepare_and_rx_handle(), which dereferences link->conf->addr.
Every other user site of ieee80211_rx_data_set_link() checks the return
and bails on failure; only this branch did not. Mirror the safe
pattern.
Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260422000651.4184602-1-michael.bommarito@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
wifi: nl80211: require admin perm on SET_PMK / DEL_PMK
NL80211_CMD_SET_PMK and NL80211_CMD_DEL_PMK manage the offloaded
4-way-handshake PMK state used by drivers advertising
NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X. The only in-tree
driver that wires up both ->set_pmk / ->del_pmk and advertises
the feature today is brcmfmac, so the practical reach of this
patch is narrow.
Both ops were introduced without a .flags gate, so the generic
netlink layer dispatches them to an unprivileged caller instead
of rejecting with -EPERM at the permission check. Every other
connection-state op in the adjacent block (CONNECT, ASSOCIATE,
AUTHENTICATE, SET_KEY, ...) carries GENL_UNS_ADMIN_PERM; SET_PMK
/ DEL_PMK were introduced without the flag in 2017 and left
unchanged by later refactors. Johannes checked the original
Intel submission history and confirmed there is no admin check
in any prior revision either, so this seems likely to be a
simple oversight rather than an intentional carve-out.
Require GENL_UNS_ADMIN_PERM so the genl layer performs the same
capable(CAP_NET_ADMIN) check as its siblings. wpa_supplicant
already needs CAP_NET_ADMIN for every other nl80211 op it issues,
so supplicant operation is unaffected. The worst case the missing
gate enables today is an unprivileged local process on a
multi-user system invalidating the offloaded PMK state of another
user's 4-way-handshake session, forcing a full EAP re-auth on the
next reconnect.
Verified in UML: an unprivileged probe (uid=1000) sees
SET_MULTICAST_TO_UNICAST (sibling op with GENL_UNS_ADMIN_PERM)
return -EPERM on both pre- and post-fix kernels, while SET_PMK /
DEL_PMK return -ENODEV from nl80211_pre_doit()'s wdev lookup pre-
fix (proving dispatch crossed the genl permission check) and
-EPERM post-fix (rejected at the genl layer as intended).
Suggested-by: Johannes Berg <johannes@sipsolutions.net> Fixes: 3a00df5707b6 ("cfg80211: support 4-way handshake offloading for 802.1X") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom> Link: https://patch.msgid.link/20260421224552.4044147-1-michael.bommarito@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
projects / thirdparty / kernel / linux.git / log
