projects/linux·commit d681d7ef

Merge misc regression fixes that seem to have fallen through the cracks

d681d7ef · Linus Torvalds <[email protected]> · 2026-09-13 10:18:23 -07:00

Thorsten continues to track regressions, and reporting on known issues
with fixes that don't seem to make any progress.

I'm going to do an rc3 release later today - let's not keep these known
issues pending for yet another rc for no obvious reason.

Reported-by: Thorsten Leemhuis <[email protected]>
Link: https://lore.kernel.org/all/[email protected]/

* regressions:
  media: ipu-bridge: do not use the CVS device lookup for IVSC
  wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe
  wifi: mt76: mt7921: skip unknown CLC firmware records
Commit
d681d7ef617ef83d6a4de36e5cb4418ef602e122
Parents
180534c0 · 856c562c

Merge commit. Changes below are compared with the first parent: 180534c0.

Changes

3 files changed · +33 −3

FileStatusAddDelContent
drivers/media/pci/intel/ipu-bridge.cmodified+24−0View file
drivers/net/wireless/mediatek/mt76/mt7921/mcu.cmodified+7−2View file
drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.cmodified+2−1View file

drivers/media/pci/intel/ipu-bridge.c

View file
diff --git a/drivers/media/pci/intel/ipu-bridge.c b/drivers/media/pci/intel/ipu-bridge.c
index 1bb3a3e..bd64c04 100644
--- a/drivers/media/pci/intel/ipu-bridge.c
+++ b/drivers/media/pci/intel/ipu-bridge.c
@@ -232,6 +232,19 @@ static const struct acpi_device_id ivsc_acpi_ids[] = {
{ "INTC10FA" }, /* NVL */
};
+/*
+ * The subset of ivsc_acpi_ids[] which are IVSC, rather than CVS, devices. The
+ * CVS IDs are deliberately not listed here: new ones keep being added, whereas
+ * this list is complete.
+ */
+static const struct acpi_device_id ivsc_only_acpi_ids[] = {
+ { "INTC1059" },
+ { "INTC1095" },
+ { "INTC100A" },
+ { "INTC10CF" },
+ { }
+};
+
static struct acpi_device *ipu_bridge_get_ivsc_acpi_dev(struct acpi_device *adev)
{
unsigned int i;
@@ -283,6 +296,17 @@ static struct device *ipu_bridge_get_ivsc_csi_dev(struct acpi_device *adev)
return csi_dev;
}
+ /*
+ * The lookups below match on the ACPI companion alone. That is fine for
+ * CVS, which binds a driver to that very device, but not for IVSC: there
+ * the ACPI device also has a driverless platform device, which would be
+ * returned instead of the mei-csi client. Return NULL for IVSC so that
+ * the caller fails and the probe is retried once the IVSC device shows
+ * up.
+ */
+ if (!acpi_match_device_ids(adev, ivsc_only_acpi_ids))
+ return NULL;
+
/* Try to locate CVS device on the I2C bus */
csi_dev = bus_find_device_by_acpi_dev(&i2c_bus_type, adev);
if (csi_dev)

drivers/net/wireless/mediatek/mt76/mt7921/mcu.c

View file
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index a118a30..4054600 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -477,18 +477,23 @@ static int mt7921_load_clc(struct mt792x_dev *dev, const char *fw_name)
for (offset = 0; offset < len; offset += clc_len) {
if (len - offset < sizeof(*clc)) {
+ dev_err(mdev->dev, "Invalid CLC record\n");
ret = -EINVAL;
goto out;
}
clc = (const struct mt7921_clc *)(clc_base + offset);
clc_len = le32_to_cpu(clc->len);
- if (clc_len < sizeof(*clc) || clc_len > len - offset ||
- clc->idx >= ARRAY_SIZE(phy->clc)) {
+ if (clc_len < sizeof(*clc) || clc_len > len - offset) {
+ dev_err(mdev->dev, "Invalid CLC record\n");
ret = -EINVAL;
goto out;
}
+ /* Newer firmware may add records this driver does not use yet */
+ if (clc->idx >= ARRAY_SIZE(phy->clc))
+ continue;
+
/* do not init buf again if chip reset triggered */
if (phy->clc[clc->idx])
continue;

drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c

View file
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c b/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
index 946dd79..b468051 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
@@ -323,7 +323,8 @@ int mt792x_init_acpi_sar_power(struct mt792x_phy *phy, bool set_default)
const struct cfg80211_sar_capa *capa = phy->mt76->hw->wiphy->sar_capa;
int i;
- if (!phy->acpisar || !((struct mt792x_acpi_sar *)phy->acpisar)->dyn)
+ if (!capa || !phy->acpisar ||
+ !((struct mt792x_acpi_sar *)phy->acpisar)->dyn)
return 0;
/* When ACPI SAR enabled in HW, we should apply rules for .frp