drop queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch

diff --git a/queue-6.12/series b/queue-6.12/series
index 8ebc55df40241af374c5501b03c4ecfcbee18745..64d8217c094279afc679dd294c725a814a12fd1f 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -229,7 +229,6 @@ drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch
 fs-fcntl-fix-softirq-unsafe-lock-order-in-fasync-signaling.patch
 driver-core-reject-devices-with-unregistered-buses.patch
 mailbox-fix-null-message-support-in-mbox_send_message.patch
-wifi-iwlwifi-fix-22000-series-smem-parsing.patch
 hv_netvsc-use-kmap_local_page-in-netvsc_copy_to_send_buf.patch
 sched_ext-don-t-warn-on-null-cgrp_moving_from-in-scx_cgroup_move_task.patch
 netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch

diff --git a/queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch b/queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch
deleted file mode 100644 (file)
index af90363..0000000
--- a/queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 58192b9ce09b0f0f86e2036683bd542130b91a98 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Mon, 10 Nov 2025 15:02:19 +0200
-Subject: wifi: iwlwifi: fix 22000 series SMEM parsing
-
-From: Johannes Berg <johannes.berg@intel.com>
-
-commit 58192b9ce09b0f0f86e2036683bd542130b91a98 upstream.
-
-If the firmware were to report three LMACs (which doesn't
-exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is
-an overrun of the array. Reject such and use IWL_FW_CHECK
-instead of WARN_ON in this function.
-
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
-Link: https://patch.msgid.link/20251110150012.16e8c2d70c26.Iadfcc1aedf43c5175b3f0757bea5aa232454f1ac@changeid
-Signed-off-by: Nazar Kalashnikov <sivartiwe@gmail.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/net/wireless/intel/iwlwifi/fw/smem.c |    8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c
-+++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
-@@ -6,6 +6,7 @@
-  */
- #include "iwl-drv.h"
- #include "runtime.h"
-+#include "dbg.h"
- #include "fw/api/commands.h"
- 
- static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
-@@ -17,7 +18,9 @@ static void iwl_parse_shared_mem_22000(s
-       u8 api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP,
-                                            SHARED_MEM_CFG_CMD, 0);
- 
--      if (WARN_ON(lmac_num > ARRAY_SIZE(mem_cfg->lmac_smem)))
-+      /* Note: notification has 3 entries, but we only expect 2 */
-+      if (IWL_FW_CHECK(fwrt, lmac_num > ARRAY_SIZE(fwrt->smem_cfg.lmac),
-+                       "FW advertises %d LMACs\n", lmac_num))
-               return;
- 
-       fwrt->smem_cfg.num_lmacs = lmac_num;
-@@ -26,7 +29,8 @@ static void iwl_parse_shared_mem_22000(s
-       fwrt->smem_cfg.rxfifo2_size = le32_to_cpu(mem_cfg->rxfifo2_size);
- 
-       if (api_ver >= 4 &&
--          !WARN_ON_ONCE(iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg))) {
-+          !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg),
-+                        "bad shared mem notification size\n")) {
-               fwrt->smem_cfg.rxfifo2_control_size =
-                       le32_to_cpu(mem_cfg->rxfifo2_control_size);
-       }