mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 11:21:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'wireless-2026-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Browse Source 
Johannes Berg says:

====================
A few last-minute fixes:
 - rfkill: prevent boundless event list
 - rt2x00: fix USB resource management
 - brcmfmac: validate firmware IDs
 - brcmsmac: fix DMA free size

* tag 'wireless-2026-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  net: rfkill: prevent unlimited numbers of rfkill events from being created
  wifi: rt2x00usb: fix devres lifetime
  wifi: brcmfmac: validate bsscfg indices in IF events
  wifi: brcmsmac: Fix dma_free_coherent() size
====================

Link: https://patch.msgid.link/20260408081802.111623-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski
2026-04-08 18:56:17 -07:00
parent 84ac9a922d ea245d78de
commit d65b175cfa
4 changed files with 31 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
View File

@@ -153,6 +153,11 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr,
bphy_err(drvr, "invalid interface index: %u\n", ifevent->ifidx);
return;
}
if (ifevent->bsscfgidx >= BRCMF_MAX_IFS) {
bphy_err(drvr, "invalid bsscfg index: %u\n",
ifevent->bsscfgidx);
return;
}
ifp = drvr->iflist[ifevent->bsscfgidx];

2
drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
View File

@@ -483,7 +483,7 @@ static void *dma_ringalloc(struct dma_info *di, u32 boundary, uint size,
if (((desc_strtaddr + size - 1) & boundary) != (desc_strtaddr
& boundary)) {
*alignbits = dma_align_sizetobits(size);
dma_free_coherent(di->dmadev, size, va, *descpa);
dma_free_coherent(di->dmadev, *alloced, va, *descpa);
va = dma_alloc_consistent(di, size, *alignbits,
alloced, descpa);
}

2
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
View File

@@ -828,7 +828,7 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
if (retval)
goto exit_free_device;
rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,
rt2x00dev->anchor = devm_kmalloc(&usb_intf->dev,
sizeof(struct usb_anchor),
GFP_KERNEL);
if (!rt2x00dev->anchor) {

35
net/rfkill/core.c
View File

@@ -73,11 +73,14 @@ struct rfkill_int_event {
struct rfkill_event_ext ev;
};
/* Max rfkill events that can be "in-flight" for one data source */
#define MAX_RFKILL_EVENT 1000
struct rfkill_data {
struct list_head list;
struct list_head events;
struct mutex mtx;
wait_queue_head_t read_wait;
u32 event_count;
bool input_handler;
u8 max_size;
};
@@ -255,10 +258,12 @@ static void rfkill_global_led_trigger_unregister(void)
}
#endif /* CONFIG_RFKILL_LEDS */
static void rfkill_fill_event(struct rfkill_event_ext *ev,
struct rfkill *rfkill,
enum rfkill_operation op)
static int rfkill_fill_event(struct rfkill_int_event *int_ev,
struct rfkill *rfkill,
struct rfkill_data *data,
enum rfkill_operation op)
{
struct rfkill_event_ext *ev = &int_ev->ev;
unsigned long flags;
ev->idx = rfkill->idx;
@@ -271,6 +276,15 @@ static void rfkill_fill_event(struct rfkill_event_ext *ev,
RFKILL_BLOCK_SW_PREV));
ev->hard_block_reasons = rfkill->hard_block_reasons;
spin_unlock_irqrestore(&rfkill->lock, flags);
scoped_guard(mutex, &data->mtx) {
if (data->event_count++ > MAX_RFKILL_EVENT) {
data->event_count--;
return -ENOSPC;
}
list_add_tail(&int_ev->list, &data->events);
}
return 0;
}
static void rfkill_send_events(struct rfkill *rfkill, enum rfkill_operation op)
@@ -282,10 +296,10 @@ static void rfkill_send_events(struct rfkill *rfkill, enum rfkill_operation op)
ev = kzalloc_obj(*ev);
if (!ev)
continue;
rfkill_fill_event(&ev->ev, rfkill, op);
mutex_lock(&data->mtx);
list_add_tail(&ev->list, &data->events);
mutex_unlock(&data->mtx);
if (rfkill_fill_event(ev, rfkill, data, op)) {
kfree(ev);
continue;
}
wake_up_interruptible(&data->read_wait);
}
}
@@ -1186,10 +1200,8 @@ static int rfkill_fop_open(struct inode *inode, struct file *file)
if (!ev)
goto free;
rfkill_sync(rfkill);
rfkill_fill_event(&ev->ev, rfkill, RFKILL_OP_ADD);
mutex_lock(&data->mtx);
list_add_tail(&ev->list, &data->events);
mutex_unlock(&data->mtx);
if (rfkill_fill_event(ev, rfkill, data, RFKILL_OP_ADD))
kfree(ev);
}
list_add(&data->list, &rfkill_fds);
mutex_unlock(&rfkill_global_mutex);
@@ -1259,6 +1271,7 @@ static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
ret = -EFAULT;
list_del(&ev->list);
data->event_count--;
kfree(ev);
out:
mutex_unlock(&data->mtx);