From: Greg Kroah-Hartman Date: Tue, 16 Jun 2026 04:20:42 +0000 (+0530) Subject: drop queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=278bb3fbcb1624ef4d192101ae4d3b5b4ceb226e;p=thirdparty%2Fkernel%2Fstable-queue.git drop queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch --- diff --git a/queue-6.12/series b/queue-6.12/series index 8ebc55df40..64d8217c09 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -229,7 +229,6 @@ drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch fs-fcntl-fix-softirq-unsafe-lock-order-in-fasync-signaling.patch driver-core-reject-devices-with-unregistered-buses.patch mailbox-fix-null-message-support-in-mbox_send_message.patch -wifi-iwlwifi-fix-22000-series-smem-parsing.patch hv_netvsc-use-kmap_local_page-in-netvsc_copy_to_send_buf.patch sched_ext-don-t-warn-on-null-cgrp_moving_from-in-scx_cgroup_move_task.patch netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch diff --git a/queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch b/queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch deleted file mode 100644 index af90363407..0000000000 --- a/queue-6.12/wifi-iwlwifi-fix-22000-series-smem-parsing.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 58192b9ce09b0f0f86e2036683bd542130b91a98 Mon Sep 17 00:00:00 2001 -From: Johannes Berg -Date: Mon, 10 Nov 2025 15:02:19 +0200 -Subject: wifi: iwlwifi: fix 22000 series SMEM parsing - -From: Johannes Berg - -commit 58192b9ce09b0f0f86e2036683bd542130b91a98 upstream. - -If the firmware were to report three LMACs (which doesn't -exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is -an overrun of the array. Reject such and use IWL_FW_CHECK -instead of WARN_ON in this function. - -Signed-off-by: Johannes Berg -Signed-off-by: Miri Korenblit -Link: https://patch.msgid.link/20251110150012.16e8c2d70c26.Iadfcc1aedf43c5175b3f0757bea5aa232454f1ac@changeid -Signed-off-by: Nazar Kalashnikov -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/wireless/intel/iwlwifi/fw/smem.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c -+++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c -@@ -6,6 +6,7 @@ - */ - #include "iwl-drv.h" - #include "runtime.h" -+#include "dbg.h" - #include "fw/api/commands.h" - - static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt, -@@ -17,7 +18,9 @@ static void iwl_parse_shared_mem_22000(s - u8 api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP, - SHARED_MEM_CFG_CMD, 0); - -- if (WARN_ON(lmac_num > ARRAY_SIZE(mem_cfg->lmac_smem))) -+ /* Note: notification has 3 entries, but we only expect 2 */ -+ if (IWL_FW_CHECK(fwrt, lmac_num > ARRAY_SIZE(fwrt->smem_cfg.lmac), -+ "FW advertises %d LMACs\n", lmac_num)) - return; - - fwrt->smem_cfg.num_lmacs = lmac_num; -@@ -26,7 +29,8 @@ static void iwl_parse_shared_mem_22000(s - fwrt->smem_cfg.rxfifo2_size = le32_to_cpu(mem_cfg->rxfifo2_size); - - if (api_ver >= 4 && -- !WARN_ON_ONCE(iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg))) { -+ !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg), -+ "bad shared mem notification size\n")) { - fwrt->smem_cfg.rxfifo2_control_size = - le32_to_cpu(mem_cfg->rxfifo2_control_size); - }