From: Greg Kroah-Hartman Date: Tue, 1 Oct 2024 11:28:09 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.6.54~65 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ca110328b99079c0f9d48a26d20fa49e99fcb33e;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: acpi-resource-add-another-dmi-match-for-the-tongfang-gmxxgxx.patch acpi-sysfs-validate-return-type-of-_str-method.patch debugobjects-fix-conditions-in-fill_pool.patch drbd-add-null-check-for-net_conf-to-prevent-dereference-in-state-validation.patch drbd-fix-atomicity-violation-in-drbd_uuid_set_bm.patch efistub-tpm-use-acpi-reclaim-memory-for-event-log-to-avoid-corruption.patch perf-x86-intel-pt-fix-sampling-synchronization.patch wifi-mt76-mt7615-check-devm_kasprintf-returned-value.patch wifi-rtw88-8822c-fix-reported-rx-band-width.patch --- diff --git a/queue-5.15/acpi-resource-add-another-dmi-match-for-the-tongfang-gmxxgxx.patch b/queue-5.15/acpi-resource-add-another-dmi-match-for-the-tongfang-gmxxgxx.patch new file mode 100644 index 00000000000..01596fa1b6b --- /dev/null +++ b/queue-5.15/acpi-resource-add-another-dmi-match-for-the-tongfang-gmxxgxx.patch @@ -0,0 +1,38 @@ +From a98cfe6ff15b62f94a44d565607a16771c847bc6 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Tue, 10 Sep 2024 11:40:06 +0200 +Subject: ACPI: resource: Add another DMI match for the TongFang GMxXGxx + +From: Werner Sembach + +commit a98cfe6ff15b62f94a44d565607a16771c847bc6 upstream. + +Internal documentation suggest that the TUXEDO Polaris 15 Gen5 AMD might +have GMxXGxX as the board name instead of GMxXGxx. + +Adding both to be on the safe side. + +Signed-off-by: Werner Sembach +Cc: All applicable +Link: https://patch.msgid.link/20240910094008.1601230-1-wse@tuxedocomputers.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/resource.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -516,6 +516,12 @@ static const struct dmi_system_id mainge + }, + }, + { ++ /* TongFang GMxXGxX/TUXEDO Polaris 15 Gen5 AMD */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"), ++ }, ++ }, ++ { + /* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."), diff --git a/queue-5.15/acpi-sysfs-validate-return-type-of-_str-method.patch b/queue-5.15/acpi-sysfs-validate-return-type-of-_str-method.patch new file mode 100644 index 00000000000..6d8426c67c6 --- /dev/null +++ b/queue-5.15/acpi-sysfs-validate-return-type-of-_str-method.patch @@ -0,0 +1,41 @@ +From 4bb1e7d027413835b086aed35bc3f0713bc0f72b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= +Date: Tue, 9 Jul 2024 22:37:24 +0200 +Subject: ACPI: sysfs: validate return type of _STR method +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +commit 4bb1e7d027413835b086aed35bc3f0713bc0f72b upstream. + +Only buffer objects are valid return values of _STR. + +If something else is returned description_show() will access invalid +memory. + +Fixes: d1efe3c324ea ("ACPI: Add new sysfs interface to export device description") +Cc: All applicable +Signed-off-by: Thomas Weißschuh +Link: https://patch.msgid.link/20240709-acpi-sysfs-groups-v2-1-058ab0667fa8@weissschuh.net +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/device_sysfs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/device_sysfs.c ++++ b/drivers/acpi/device_sysfs.c +@@ -543,8 +543,9 @@ int acpi_device_setup_files(struct acpi_ + * If device has _STR, 'description' file is created + */ + if (acpi_has_method(dev->handle, "_STR")) { +- status = acpi_evaluate_object(dev->handle, "_STR", +- NULL, &buffer); ++ status = acpi_evaluate_object_typed(dev->handle, "_STR", ++ NULL, &buffer, ++ ACPI_TYPE_BUFFER); + if (ACPI_FAILURE(status)) + buffer.pointer = NULL; + dev->pnp.str_obj = buffer.pointer; diff --git a/queue-5.15/debugobjects-fix-conditions-in-fill_pool.patch b/queue-5.15/debugobjects-fix-conditions-in-fill_pool.patch new file mode 100644 index 00000000000..a44d0226819 --- /dev/null +++ b/queue-5.15/debugobjects-fix-conditions-in-fill_pool.patch @@ -0,0 +1,49 @@ +From 684d28feb8546d1e9597aa363c3bfcf52fe250b7 Mon Sep 17 00:00:00 2001 +From: Zhen Lei +Date: Wed, 4 Sep 2024 21:39:40 +0800 +Subject: debugobjects: Fix conditions in fill_pool() + +From: Zhen Lei + +commit 684d28feb8546d1e9597aa363c3bfcf52fe250b7 upstream. + +fill_pool() uses 'obj_pool_min_free' to decide whether objects should be +handed back to the kmem cache. But 'obj_pool_min_free' records the lowest +historical value of the number of objects in the object pool and not the +minimum number of objects which should be kept in the pool. + +Use 'debug_objects_pool_min_level' instead, which holds the minimum number +which was scaled to the number of CPUs at boot time. + +[ tglx: Massage change log ] + +Fixes: d26bf5056fc0 ("debugobjects: Reduce number of pool_lock acquisitions in fill_pool()") +Fixes: 36c4ead6f6df ("debugobjects: Add global free list and the counter") +Signed-off-by: Zhen Lei +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20240904133944.2124-3-thunder.leizhen@huawei.com +Signed-off-by: Greg Kroah-Hartman +--- + lib/debugobjects.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -144,13 +144,14 @@ static void fill_pool(void) + * READ_ONCE()s pair with the WRITE_ONCE()s in pool_lock critical + * sections. + */ +- while (READ_ONCE(obj_nr_tofree) && (READ_ONCE(obj_pool_free) < obj_pool_min_free)) { ++ while (READ_ONCE(obj_nr_tofree) && ++ READ_ONCE(obj_pool_free) < debug_objects_pool_min_level) { + raw_spin_lock_irqsave(&pool_lock, flags); + /* + * Recheck with the lock held as the worker thread might have + * won the race and freed the global free list already. + */ +- while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) { ++ while (obj_nr_tofree && (obj_pool_free < debug_objects_pool_min_level)) { + obj = hlist_entry(obj_to_free.first, typeof(*obj), node); + hlist_del(&obj->node); + WRITE_ONCE(obj_nr_tofree, obj_nr_tofree - 1); diff --git a/queue-5.15/drbd-add-null-check-for-net_conf-to-prevent-dereference-in-state-validation.patch b/queue-5.15/drbd-add-null-check-for-net_conf-to-prevent-dereference-in-state-validation.patch new file mode 100644 index 00000000000..df3f8689701 --- /dev/null +++ b/queue-5.15/drbd-add-null-check-for-net_conf-to-prevent-dereference-in-state-validation.patch @@ -0,0 +1,36 @@ +From a5e61b50c9f44c5edb6e134ede6fee8806ffafa9 Mon Sep 17 00:00:00 2001 +From: Mikhail Lobanov +Date: Mon, 9 Sep 2024 09:37:36 -0400 +Subject: drbd: Add NULL check for net_conf to prevent dereference in state validation + +From: Mikhail Lobanov + +commit a5e61b50c9f44c5edb6e134ede6fee8806ffafa9 upstream. + +If the net_conf pointer is NULL and the code attempts to access its +fields without a check, it will lead to a null pointer dereference. +Add a NULL check before dereferencing the pointer. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf") +Cc: stable@vger.kernel.org +Signed-off-by: Mikhail Lobanov +Link: https://lore.kernel.org/r/20240909133740.84297-1-m.lobanov@rosalinux.ru +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/drbd/drbd_state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/drbd/drbd_state.c ++++ b/drivers/block/drbd/drbd_state.c +@@ -876,7 +876,7 @@ is_valid_state(struct drbd_device *devic + ns.disk == D_OUTDATED) + rv = SS_CONNECTED_OUTDATES; + +- else if ((ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) && ++ else if (nc && (ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) && + (nc->verify_alg[0] == 0)) + rv = SS_NO_VERIFY_ALG; + diff --git a/queue-5.15/drbd-fix-atomicity-violation-in-drbd_uuid_set_bm.patch b/queue-5.15/drbd-fix-atomicity-violation-in-drbd_uuid_set_bm.patch new file mode 100644 index 00000000000..65e911f4e94 --- /dev/null +++ b/queue-5.15/drbd-fix-atomicity-violation-in-drbd_uuid_set_bm.patch @@ -0,0 +1,58 @@ +From 2f02b5af3a4482b216e6a466edecf6ba8450fa45 Mon Sep 17 00:00:00 2001 +From: Qiu-ji Chen +Date: Fri, 13 Sep 2024 16:35:04 +0800 +Subject: drbd: Fix atomicity violation in drbd_uuid_set_bm() + +From: Qiu-ji Chen + +commit 2f02b5af3a4482b216e6a466edecf6ba8450fa45 upstream. + +The violation of atomicity occurs when the drbd_uuid_set_bm function is +executed simultaneously with modifying the value of +device->ldev->md.uuid[UI_BITMAP]. Consider a scenario where, while +device->ldev->md.uuid[UI_BITMAP] passes the validity check when its +value is not zero, the value of device->ldev->md.uuid[UI_BITMAP] is +written to zero. In this case, the check in drbd_uuid_set_bm might refer +to the old value of device->ldev->md.uuid[UI_BITMAP] (before locking), +which allows an invalid value to pass the validity check, resulting in +inconsistency. + +To address this issue, it is recommended to include the data validity +check within the locked section of the function. This modification +ensures that the value of device->ldev->md.uuid[UI_BITMAP] does not +change during the validation process, thereby maintaining its integrity. + +This possible bug is found by an experimental static analysis tool +developed by our team. This tool analyzes the locking APIs to extract +function pairs that can be concurrently executed, and then analyzes the +instructions in the paired functions to identify possible concurrency +bugs including data races and atomicity violations. + +Fixes: 9f2247bb9b75 ("drbd: Protect accesses to the uuid set with a spinlock") +Cc: stable@vger.kernel.org +Signed-off-by: Qiu-ji Chen +Reviewed-by: Philipp Reisner +Link: https://lore.kernel.org/r/20240913083504.10549-1-chenqiuji666@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/drbd/drbd_main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -3406,10 +3406,12 @@ void drbd_uuid_new_current(struct drbd_d + void drbd_uuid_set_bm(struct drbd_device *device, u64 val) __must_hold(local) + { + unsigned long flags; +- if (device->ldev->md.uuid[UI_BITMAP] == 0 && val == 0) ++ spin_lock_irqsave(&device->ldev->md.uuid_lock, flags); ++ if (device->ldev->md.uuid[UI_BITMAP] == 0 && val == 0) { ++ spin_unlock_irqrestore(&device->ldev->md.uuid_lock, flags); + return; ++ } + +- spin_lock_irqsave(&device->ldev->md.uuid_lock, flags); + if (val == 0) { + drbd_uuid_move_history(device); + device->ldev->md.uuid[UI_HISTORY_START] = device->ldev->md.uuid[UI_BITMAP]; diff --git a/queue-5.15/efistub-tpm-use-acpi-reclaim-memory-for-event-log-to-avoid-corruption.patch b/queue-5.15/efistub-tpm-use-acpi-reclaim-memory-for-event-log-to-avoid-corruption.patch new file mode 100644 index 00000000000..cdb30b003a7 --- /dev/null +++ b/queue-5.15/efistub-tpm-use-acpi-reclaim-memory-for-event-log-to-avoid-corruption.patch @@ -0,0 +1,45 @@ +From 77d48d39e99170b528e4f2e9fc5d1d64cdedd386 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 12 Sep 2024 17:45:49 +0200 +Subject: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption + +From: Ard Biesheuvel + +commit 77d48d39e99170b528e4f2e9fc5d1d64cdedd386 upstream. + +The TPM event log table is a Linux specific construct, where the data +produced by the GetEventLog() boot service is cached in memory, and +passed on to the OS using an EFI configuration table. + +The use of EFI_LOADER_DATA here results in the region being left +unreserved in the E820 memory map constructed by the EFI stub, and this +is the memory description that is passed on to the incoming kernel by +kexec, which is therefore unaware that the region should be reserved. + +Even though the utility of the TPM2 event log after a kexec is +questionable, any corruption might send the parsing code off into the +weeds and crash the kernel. So let's use EFI_ACPI_RECLAIM_MEMORY +instead, which is always treated as reserved by the E820 conversion +logic. + +Cc: +Reported-by: Breno Leitao +Tested-by: Usama Arif +Reviewed-by: Ilias Apalodimas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/efi/libstub/tpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/firmware/efi/libstub/tpm.c ++++ b/drivers/firmware/efi/libstub/tpm.c +@@ -115,7 +115,7 @@ void efi_retrieve_tpm2_eventlog(void) + } + + /* Allocate space for the logs and copy them. */ +- status = efi_bs_call(allocate_pool, EFI_LOADER_DATA, ++ status = efi_bs_call(allocate_pool, EFI_ACPI_RECLAIM_MEMORY, + sizeof(*log_tbl) + log_size, (void **)&log_tbl); + + if (status != EFI_SUCCESS) { diff --git a/queue-5.15/perf-x86-intel-pt-fix-sampling-synchronization.patch b/queue-5.15/perf-x86-intel-pt-fix-sampling-synchronization.patch new file mode 100644 index 00000000000..7dde319b292 --- /dev/null +++ b/queue-5.15/perf-x86-intel-pt-fix-sampling-synchronization.patch @@ -0,0 +1,71 @@ +From d92792a4b26e50b96ab734cbe203d8a4c932a7a9 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 15 Jul 2024 19:07:00 +0300 +Subject: perf/x86/intel/pt: Fix sampling synchronization + +From: Adrian Hunter + +commit d92792a4b26e50b96ab734cbe203d8a4c932a7a9 upstream. + +pt_event_snapshot_aux() uses pt->handle_nmi to determine if tracing +needs to be stopped, however tracing can still be going because +pt->handle_nmi is set to zero before tracing is stopped in pt_event_stop, +whereas pt_event_snapshot_aux() requires that tracing must be stopped in +order to copy a sample of trace from the buffer. + +Instead call pt_config_stop() always, which anyway checks config for +RTIT_CTL_TRACEEN and does nothing if it is already clear. + +Note pt_event_snapshot_aux() can continue to use pt->handle_nmi to +determine if the trace needs to be restarted afterwards. + +Fixes: 25e8920b301c ("perf/x86/intel/pt: Add sampling support") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20240715160712.127117-2-adrian.hunter@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/pt.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/arch/x86/events/intel/pt.c ++++ b/arch/x86/events/intel/pt.c +@@ -1586,6 +1586,7 @@ static void pt_event_stop(struct perf_ev + * see comment in intel_pt_interrupt(). + */ + WRITE_ONCE(pt->handle_nmi, 0); ++ barrier(); + + pt_config_stop(event); + +@@ -1637,11 +1638,10 @@ static long pt_event_snapshot_aux(struct + return 0; + + /* +- * Here, handle_nmi tells us if the tracing is on ++ * There is no PT interrupt in this mode, so stop the trace and it will ++ * remain stopped while the buffer is copied. + */ +- if (READ_ONCE(pt->handle_nmi)) +- pt_config_stop(event); +- ++ pt_config_stop(event); + pt_read_offset(buf); + pt_update_head(pt); + +@@ -1653,11 +1653,10 @@ static long pt_event_snapshot_aux(struct + ret = perf_output_copy_aux(&pt->handle, handle, from, to); + + /* +- * If the tracing was on when we turned up, restart it. +- * Compiler barrier not needed as we couldn't have been +- * preempted by anything that touches pt->handle_nmi. ++ * Here, handle_nmi tells us if the tracing was on. ++ * If the tracing was on, restart it. + */ +- if (pt->handle_nmi) ++ if (READ_ONCE(pt->handle_nmi)) + pt_config_start(event); + + return ret; diff --git a/queue-5.15/series b/queue-5.15/series index a68b4c5eaad..27c6ba1b3d4 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -322,3 +322,12 @@ firmware_loader-block-path-traversal.patch tty-rp2-fix-reset-with-non-forgiving-pcie-host-bridges.patch xhci-set-quirky-xhc-pci-hosts-to-d3-_after_-stopping-and-freeing-them.patch crypto-ccp-properly-unregister-dev-sev-on-sev-platform_status-failure.patch +drbd-fix-atomicity-violation-in-drbd_uuid_set_bm.patch +drbd-add-null-check-for-net_conf-to-prevent-dereference-in-state-validation.patch +acpi-sysfs-validate-return-type-of-_str-method.patch +acpi-resource-add-another-dmi-match-for-the-tongfang-gmxxgxx.patch +efistub-tpm-use-acpi-reclaim-memory-for-event-log-to-avoid-corruption.patch +perf-x86-intel-pt-fix-sampling-synchronization.patch +wifi-rtw88-8822c-fix-reported-rx-band-width.patch +wifi-mt76-mt7615-check-devm_kasprintf-returned-value.patch +debugobjects-fix-conditions-in-fill_pool.patch diff --git a/queue-5.15/wifi-mt76-mt7615-check-devm_kasprintf-returned-value.patch b/queue-5.15/wifi-mt76-mt7615-check-devm_kasprintf-returned-value.patch new file mode 100644 index 00000000000..f481a708edc --- /dev/null +++ b/queue-5.15/wifi-mt76-mt7615-check-devm_kasprintf-returned-value.patch @@ -0,0 +1,37 @@ +From 5acdc432f832d810e0d638164c393b877291d9b4 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 5 Sep 2024 09:47:53 +0800 +Subject: wifi: mt76: mt7615: check devm_kasprintf() returned value + +From: Ma Ke + +commit 5acdc432f832d810e0d638164c393b877291d9b4 upstream. + +devm_kasprintf() can return a NULL pointer on failure but this returned +value is not checked. Fix this lack and check the returned value. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: 0bb4e9187ea4 ("mt76: mt7615: fix hwmon temp sensor mem use-after-free") +Signed-off-by: Ma Ke +Reviewed-by: Matthias Brugger +Link: https://patch.msgid.link/20240905014753.353271-1-make24@iscas.ac.cn +Signed-off-by: Felix Fietkau +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/mt7615/init.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c +@@ -56,6 +56,9 @@ int mt7615_thermal_init(struct mt7615_de + + name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7615_%s", + wiphy_name(wiphy)); ++ if (!name) ++ return -ENOMEM; ++ + hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, dev, + mt7615_hwmon_groups); + if (IS_ERR(hwmon)) diff --git a/queue-5.15/wifi-rtw88-8822c-fix-reported-rx-band-width.patch b/queue-5.15/wifi-rtw88-8822c-fix-reported-rx-band-width.patch new file mode 100644 index 00000000000..6665d997b44 --- /dev/null +++ b/queue-5.15/wifi-rtw88-8822c-fix-reported-rx-band-width.patch @@ -0,0 +1,58 @@ +From a71ed5898dfae68262f79277915d1dfe34586bc6 Mon Sep 17 00:00:00 2001 +From: Bitterblue Smith +Date: Tue, 23 Jul 2024 22:31:36 +0300 +Subject: wifi: rtw88: 8822c: Fix reported RX band width + +From: Bitterblue Smith + +commit a71ed5898dfae68262f79277915d1dfe34586bc6 upstream. + +"iw dev wlp2s0 station dump" shows incorrect rx bitrate: + +tx bitrate: 866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2 +rx bitrate: 86.7 MBit/s VHT-MCS 9 VHT-NSS 1 + +This is because the RX band width is calculated incorrectly. Fix the +calculation according to the phydm_rxsc_2_bw() function from the +official drivers. + +After: + +tx bitrate: 866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2 +rx bitrate: 390.0 MBit/s VHT-MCS 9 80MHz VHT-NSS 1 + +It also works correctly with the AP configured for 20 MHz and 40 MHz. + +Tested with RTL8822CE. + +Cc: stable@vger.kernel.org +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Signed-off-by: Bitterblue Smith +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/bca8949b-e2bd-4515-98fd-70d3049a0097@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtw88/rtw8822c.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c +@@ -2584,12 +2584,14 @@ static void query_phy_status_page1(struc + else + rxsc = GET_PHY_STAT_P1_HT_RXSC(phy_status); + +- if (rxsc >= 9 && rxsc <= 12) ++ if (rxsc == 0) ++ bw = rtwdev->hal.current_band_width; ++ else if (rxsc >= 1 && rxsc <= 8) ++ bw = RTW_CHANNEL_WIDTH_20; ++ else if (rxsc >= 9 && rxsc <= 12) + bw = RTW_CHANNEL_WIDTH_40; +- else if (rxsc >= 13) +- bw = RTW_CHANNEL_WIDTH_80; + else +- bw = RTW_CHANNEL_WIDTH_20; ++ bw = RTW_CHANNEL_WIDTH_80; + + pkt_stat->rx_power[RF_PATH_A] = GET_PHY_STAT_P1_PWDB_A(phy_status) - 110; + pkt_stat->rx_power[RF_PATH_B] = GET_PHY_STAT_P1_PWDB_B(phy_status) - 110;