[PATCH 0/4] Backport CVE fixes to 6.12.y

[PATCH 0/4] Backport CVE fixes to 6.12.y

[Amelia Crate]

These patches backport the following upstream commits fixing CVEs to the Linux 6.12.y stable tree.

CVE-2025-21833 -> 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
CVE-2025-37803 -> 021ba7f1babd ("udmabuf: fix a buf size overflow issue during udmabuf creation")
CVE-2024-57995 -> 5a10971c7645 ("wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()")
CVE-2025-37860 -> 8241ecec1cdc6 ("sfc: fix NULL dereferences in ef100_process_design_param()")

The following upstream commit applies cleanly to v6.12.y, please pick it up.

CVE-2024-58097 -> 16c6c35c03ea ("wifi: ath11k: fix RCU stall while reaping monitor destination ring")

[PATCH 1/4] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE

[Amelia Crate]

From f1cefc290c20c30c37b01d44b42ca5c9b6d32913 Mon Sep 17 00:00:00 2001
From: Kees Bakker <kees@ijzerbout.nl>
Date: Tue, 7 Jan 2025 10:17:42 +0800
Subject: [PATCH 1/4] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE

[ Upstream commit 60f030f7418d3f1d94f2fb207fe3080e1844630b ]

There is a WARN_ON_ONCE to catch an unlikely situation when
domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless
happens we must avoid using a NULL pointer.

Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
Link: https://lore.kernel.org/r/20241218201048.E544818E57E@bout3.ijzerbout.nl
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Amelia Crate <acrate@waldn.net>
---
 drivers/iommu/intel/iommu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 667407974e23..c799cc67db34 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -4328,13 +4328,14 @@ static void intel_iommu_remove_dev_pasid(struct device *dev, ioasid_t pasid,
             break;
         }
     }
-    WARN_ON_ONCE(!dev_pasid);
     spin_unlock_irqrestore(&dmar_domain->lock, flags);

     cache_tag_unassign_domain(dmar_domain, dev, pasid);
     domain_detach_iommu(dmar_domain, iommu);
-    intel_iommu_debugfs_remove_dev_pasid(dev_pasid);
-    kfree(dev_pasid);
+    if (!WARN_ON_ONCE(!dev_pasid)) {
+        intel_iommu_debugfs_remove_dev_pasid(dev_pasid);
+        kfree(dev_pasid);
+    }
     intel_pasid_tear_down_entry(iommu, dev, pasid, false);
     intel_drain_pasid_prq(dev, pasid);
 }
--
2.50.1

[PATCH 2/4] udmabuf: fix a buf size overflow issue during udmabuf creation

[Amelia Crate]

From 2975117abd1c11f5867b0960a8e467c8f5d394ad Mon Sep 17 00:00:00 2001
From: Xiaogang Chen <xiaogang.chen@amd.com>
Date: Fri, 21 Mar 2025 11:41:26 -0500
Subject: [PATCH 2/4] udmabuf: fix a buf size overflow issue during udmabuf
 creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 021ba7f1babd029e714d13a6bf2571b08af96d0f ]

by casting size_limit_mb to u64  when calculate pglimit.

Signed-off-by: Xiaogang Chen<Xiaogang.Chen@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250321164126.329638-1-xiaogang.chen@amd.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Amelia Crate <acrate@waldn.net>
---
 drivers/dma-buf/udmabuf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 0e127a9109e7..2e5c30f7ba0f 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -350,7 +350,7 @@ static long udmabuf_create(struct miscdevice *device,
         return -ENOMEM;

     INIT_LIST_HEAD(&ubuf->unpin_list);
-    pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+    pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
     for (i = 0; i < head->count; i++) {
         if (!PAGE_ALIGNED(list[i].offset))
             goto err;
--
2.50.1

[PATCH 3/4] wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()

[Amelia Crate]

From bdf6ae776fd6536127b8765a38bfb2a96e9c7a29 Mon Sep 17 00:00:00 2001
From: Aditya Kumar Singh <quic_adisi@quicinc.com>
Date: Tue, 10 Dec 2024 10:56:33 +0530
Subject: [PATCH 3/4] wifi: ath12k: fix read pointer after free in
 ath12k_mac_assign_vif_to_vdev()

[ Upstream commit 5a10971c7645a95f5d5dc23c26fbac4bf61801d0 ]

In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different
radio, it gets deleted from that radio through a call to
ath12k_mac_unassign_link_vif(). This action frees the arvif pointer.
Subsequently, there is a check involving arvif, which will result in a
read-after-free scenario.

Fix this by moving this check after arvif is again assigned via call to
ath12k_mac_assign_link_vif().

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1

Closes: https://scan5.scan.coverity.com/#/project-view/63541/10063?selectedIssue=1636423
Fixes: b5068bc9180d ("wifi: ath12k: Cache vdev configs before vdev create")
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Acked-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Acked-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20241210-read_after_free-v1-1-969f69c7d66c@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Amelia Crate <acrate@waldn.net>
---
 drivers/net/wireless/ath/ath12k/mac.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 4b3fbec397ac..c15eecf2a188 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -6733,15 +6733,15 @@ static struct ath12k *ath12k_mac_assign_vif_to_vdev(struct ieee80211_hw *hw,

     mutex_lock(&ar->conf_mutex);

-    if (arvif->is_created)
-        goto flush;
-
     if (vif->type == NL80211_IFTYPE_AP &&
         ar->num_peers > (ar->max_num_peers - 1)) {
         ath12k_warn(ab, "failed to create vdev due to insufficient peer entry resource in firmware\n");
         goto unlock;
     }

+    if (arvif->is_created)
+        goto flush;
+
     if (ar->num_created_vdevs > (TARGET_NUM_VDEVS - 1)) {
         ath12k_warn(ab, "failed to create vdev, reached max vdev limit %d\n",
                 TARGET_NUM_VDEVS);
--
2.50.1

[PATCH 4/4] sfc: fix NULL dereferences in ef100_process_design_param()

[Amelia Crate]

From b352b49724e0bc21ba8679a5a8aaf4d8adb660d0 Mon Sep 17 00:00:00 2001
From: Edward Cree <ecree.xilinx@gmail.com>
Date: Tue, 1 Apr 2025 23:54:39 +0100
Subject: [PATCH 4/4] sfc: fix NULL dereferences in
 ef100_process_design_param()

[ Upstream commit 8241ecec1cdc6699ae197d52d58e76bddd995fa5 ]

Since cited commit, ef100_probe_main() and hence also
 ef100_check_design_params() run before efx->net_dev is created;
 consequently, we cannot netif_set_tso_max_size() or _segs() at this
 point.
Move those netif calls to ef100_probe_netdev(), and also replace
 netif_err within the design params code with pci_err.

Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Fixes: 98ff4c7c8ac7 ("sfc: Separate netdev probe/remove from PCI probe/remove")
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Link: https://patch.msgid.link/20250401225439.2401047-1-edward.cree@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Amelia Crate <acrate@waldn.net>
---
 drivers/net/ethernet/sfc/ef100_netdev.c |  6 ++--
 drivers/net/ethernet/sfc/ef100_nic.c    | 47 +++++++++++--------------
 2 files changed, 24 insertions(+), 29 deletions(-)

diff --git a/drivers/net/ethernet/sfc/ef100_netdev.c b/drivers/net/ethernet/sfc/ef100_netdev.c
index 7f7d560cb2b4..14dcca4ffb33 100644
--- a/drivers/net/ethernet/sfc/ef100_netdev.c
+++ b/drivers/net/ethernet/sfc/ef100_netdev.c
@@ -450,8 +450,9 @@ int ef100_probe_netdev(struct efx_probe_data *probe_data)
     net_dev->hw_enc_features |= efx->type->offload_features;
     net_dev->vlan_features |= NETIF_F_HW_CSUM | NETIF_F_SG |
                   NETIF_F_HIGHDMA | NETIF_F_ALL_TSO;
-    netif_set_tso_max_segs(net_dev,
-                   ESE_EF100_DP_GZ_TSO_MAX_HDR_NUM_SEGS_DEFAULT);
+    nic_data = efx->nic_data;
+    netif_set_tso_max_size(efx->net_dev, nic_data->tso_max_payload_len);
+    netif_set_tso_max_segs(efx->net_dev, nic_data->tso_max_payload_num_segs);
     efx->mdio.dev = net_dev;

     rc = efx_ef100_init_datapath_caps(efx);
@@ -478,7 +479,6 @@ int ef100_probe_netdev(struct efx_probe_data *probe_data)
     /* Don't fail init if RSS setup doesn't work. */
     efx_mcdi_push_default_indir_table(efx, efx->n_rx_channels);

-    nic_data = efx->nic_data;
     rc = ef100_get_mac_address(efx, net_dev->perm_addr, CLIENT_HANDLE_SELF,
                    efx->type->is_vf);
     if (rc)
diff --git a/drivers/net/ethernet/sfc/ef100_nic.c b/drivers/net/ethernet/sfc/ef100_nic.c
index 6da06931187d..5b1bdcac81d9 100644
--- a/drivers/net/ethernet/sfc/ef100_nic.c
+++ b/drivers/net/ethernet/sfc/ef100_nic.c
@@ -887,8 +887,7 @@ static int ef100_process_design_param(struct efx_nic *efx,
     case ESE_EF100_DP_GZ_TSO_MAX_HDR_NUM_SEGS:
         /* We always put HDR_NUM_SEGS=1 in our TSO descriptors */
         if (!reader->value) {
-            netif_err(efx, probe, efx->net_dev,
-                  "TSO_MAX_HDR_NUM_SEGS < 1\n");
+            pci_err(efx->pci_dev, "TSO_MAX_HDR_NUM_SEGS < 1\n");
             return -EOPNOTSUPP;
         }
         return 0;
@@ -901,32 +900,28 @@ static int ef100_process_design_param(struct efx_nic *efx,
          */
         if (!reader->value || reader->value > EFX_MIN_DMAQ_SIZE ||
             EFX_MIN_DMAQ_SIZE % (u32)reader->value) {
-            netif_err(efx, probe, efx->net_dev,
-                  "%s size granularity is %llu, can't guarantee safety\n",
-                  reader->type == ESE_EF100_DP_GZ_RXQ_SIZE_GRANULARITY ? "RXQ" : "TXQ",
-                  reader->value);
+            pci_err(efx->pci_dev,
+                "%s size granularity is %llu, can't guarantee safety\n",
+                reader->type == ESE_EF100_DP_GZ_RXQ_SIZE_GRANULARITY ? "RXQ" : "TXQ",
+                reader->value);
             return -EOPNOTSUPP;
         }
         return 0;
     case ESE_EF100_DP_GZ_TSO_MAX_PAYLOAD_LEN:
         nic_data->tso_max_payload_len = min_t(u64, reader->value,
                               GSO_LEGACY_MAX_SIZE);
-        netif_set_tso_max_size(efx->net_dev,
-                       nic_data->tso_max_payload_len);
         return 0;
     case ESE_EF100_DP_GZ_TSO_MAX_PAYLOAD_NUM_SEGS:
         nic_data->tso_max_payload_num_segs = min_t(u64, reader->value, 0xffff);
-        netif_set_tso_max_segs(efx->net_dev,
-                       nic_data->tso_max_payload_num_segs);
         return 0;
     case ESE_EF100_DP_GZ_TSO_MAX_NUM_FRAMES:
         nic_data->tso_max_frames = min_t(u64, reader->value, 0xffff);
         return 0;
     case ESE_EF100_DP_GZ_COMPAT:
         if (reader->value) {
-            netif_err(efx, probe, efx->net_dev,
-                  "DP_COMPAT has unknown bits %#llx, driver not compatible with this hw\n",
-                  reader->value);
+            pci_err(efx->pci_dev,
+                "DP_COMPAT has unknown bits %#llx, driver not compatible with this hw\n",
+                reader->value);
             return -EOPNOTSUPP;
         }
         return 0;
@@ -946,10 +941,10 @@ static int ef100_process_design_param(struct efx_nic *efx,
          * So the value of this shouldn't matter.
          */
         if (reader->value != ESE_EF100_DP_GZ_VI_STRIDES_DEFAULT)
-            netif_dbg(efx, probe, efx->net_dev,
-                  "NIC has other than default VI_STRIDES (mask "
-                  "%#llx), early probing might use wrong one\n",
-                  reader->value);
+            pci_dbg(efx->pci_dev,
+                "NIC has other than default VI_STRIDES (mask "
+                "%#llx), early probing might use wrong one\n",
+                reader->value);
         return 0;
     case ESE_EF100_DP_GZ_RX_MAX_RUNT:
         /* Driver doesn't look at L2_STATUS:LEN_ERR bit, so we don't
@@ -961,9 +956,9 @@ static int ef100_process_design_param(struct efx_nic *efx,
         /* Host interface says "Drivers should ignore design parameters
          * that they do not recognise."
          */
-        netif_dbg(efx, probe, efx->net_dev,
-              "Ignoring unrecognised design parameter %u\n",
-              reader->type);
+        pci_dbg(efx->pci_dev,
+            "Ignoring unrecognised design parameter %u\n",
+            reader->type);
         return 0;
     }
 }
@@ -999,13 +994,13 @@ static int ef100_check_design_params(struct efx_nic *efx)
      */
     if (reader.state != EF100_TLV_TYPE) {
         if (reader.state == EF100_TLV_TYPE_CONT)
-            netif_err(efx, probe, efx->net_dev,
-                  "truncated design parameter (incomplete type %u)\n",
-                  reader.type);
+            pci_err(efx->pci_dev,
+                "truncated design parameter (incomplete type %u)\n",
+                reader.type);
         else
-            netif_err(efx, probe, efx->net_dev,
-                  "truncated design parameter %u\n",
-                  reader.type);
+            pci_err(efx->pci_dev,
+                "truncated design parameter %u\n",
+                reader.type);
         rc = -EIO;
     }
 out:
--
2.50.1

Re: [PATCH 0/4] Backport CVE fixes to 6.12.y

[Greg KH]

On Wed, Oct 29, 2025 at 05:24:59PM -0500, Amelia Crate wrote:
> These patches backport the following upstream commits fixing CVEs to the Linux 6.12.y stable tree.
> 
> CVE-2025-21833 -> 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
> CVE-2025-37803 -> 021ba7f1babd ("udmabuf: fix a buf size overflow issue during udmabuf creation")
> CVE-2024-57995 -> 5a10971c7645 ("wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()")
> CVE-2025-37860 -> 8241ecec1cdc6 ("sfc: fix NULL dereferences in ef100_process_design_param()")
> 
> The following upstream commit applies cleanly to v6.12.y, please pick it up.
> 
> CVE-2024-58097 -> 16c6c35c03ea ("wifi: ath11k: fix RCU stall while reaping monitor destination ring")
> 
> 
> 

All of these seem to be attached (with full git headers?) and the
whitespace is corrupted and can not be applied at all :(

Can you resend these using something like git send-email which will fix
all of that up properly?

thanks,

greg k-h

[PATCH v2 0/4] Backport CVE fixes to 6.12.y

[Amelia Crate]

Sorry about that, I was fighting with my email client to send plaintext but I guess I was unsuccessful. I had just included the full git format-patch output with default options.

Here's the series sent by git send-email, if I need to do something else let me know.

Resent after leaving the mailing list off CC, sorry for noise.

Aditya Kumar Singh (1):
  wifi: ath12k: fix read pointer after free in
    ath12k_mac_assign_vif_to_vdev()

Edward Cree (1):
  sfc: fix NULL dereferences in ef100_process_design_param()

Kees Bakker (1):
  iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE

Xiaogang Chen (1):
  udmabuf: fix a buf size overflow issue during udmabuf creation

 drivers/dma-buf/udmabuf.c               |  2 +-
 drivers/iommu/intel/iommu.c             |  7 ++--
 drivers/net/ethernet/sfc/ef100_netdev.c |  6 ++--
 drivers/net/ethernet/sfc/ef100_nic.c    | 47 +++++++++++--------------
 drivers/net/wireless/ath/ath12k/mac.c   |  6 ++--
 5 files changed, 32 insertions(+), 36 deletions(-)

-- 
2.50.1

[PATCH v2 1/4] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE

[Amelia Crate]

From: Kees Bakker <kees@ijzerbout.nl>

[ Upstream commit 60f030f7418d3f1d94f2fb207fe3080e1844630b ]

There is a WARN_ON_ONCE to catch an unlikely situation when
domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless
happens we must avoid using a NULL pointer.

Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
Link: https://lore.kernel.org/r/20241218201048.E544818E57E@bout3.ijzerbout.nl
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Amelia Crate <acrate@waldn.net>
---
 drivers/iommu/intel/iommu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 667407974e23..c799cc67db34 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -4328,13 +4328,14 @@ static void intel_iommu_remove_dev_pasid(struct device *dev, ioasid_t pasid,
 			break;
 		}
 	}
-	WARN_ON_ONCE(!dev_pasid);
 	spin_unlock_irqrestore(&dmar_domain->lock, flags);
 
 	cache_tag_unassign_domain(dmar_domain, dev, pasid);
 	domain_detach_iommu(dmar_domain, iommu);
-	intel_iommu_debugfs_remove_dev_pasid(dev_pasid);
-	kfree(dev_pasid);
+	if (!WARN_ON_ONCE(!dev_pasid)) {
+		intel_iommu_debugfs_remove_dev_pasid(dev_pasid);
+		kfree(dev_pasid);
+	}
 	intel_pasid_tear_down_entry(iommu, dev, pasid, false);
 	intel_drain_pasid_prq(dev, pasid);
 }
-- 
2.50.1

[PATCH v2 2/4] udmabuf: fix a buf size overflow issue during udmabuf creation

[Amelia Crate]

From: Xiaogang Chen <xiaogang.chen@amd.com>

[ Upstream commit 021ba7f1babd029e714d13a6bf2571b08af96d0f ]

by casting size_limit_mb to u64  when calculate pglimit.

Signed-off-by: Xiaogang Chen<Xiaogang.Chen@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250321164126.329638-1-xiaogang.chen@amd.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Amelia Crate <acrate@waldn.net>
---
 drivers/dma-buf/udmabuf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 0e127a9109e7..2e5c30f7ba0f 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -350,7 +350,7 @@ static long udmabuf_create(struct miscdevice *device,
 		return -ENOMEM;
 
 	INIT_LIST_HEAD(&ubuf->unpin_list);
-	pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+	pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
 	for (i = 0; i < head->count; i++) {
 		if (!PAGE_ALIGNED(list[i].offset))
 			goto err;
-- 
2.50.1

[PATCH v2 3/4] wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()

[Amelia Crate]

From: Aditya Kumar Singh <quic_adisi@quicinc.com>

[ Upstream commit 5a10971c7645a95f5d5dc23c26fbac4bf61801d0 ]

In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different
radio, it gets deleted from that radio through a call to
ath12k_mac_unassign_link_vif(). This action frees the arvif pointer.
Subsequently, there is a check involving arvif, which will result in a
read-after-free scenario.

Fix this by moving this check after arvif is again assigned via call to
ath12k_mac_assign_link_vif().

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1

Closes: https://scan5.scan.coverity.com/#/project-view/63541/10063?selectedIssue=1636423
Fixes: b5068bc9180d ("wifi: ath12k: Cache vdev configs before vdev create")
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Acked-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Acked-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20241210-read_after_free-v1-1-969f69c7d66c@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Amelia Crate <acrate@waldn.net>
---
 drivers/net/wireless/ath/ath12k/mac.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 4b3fbec397ac..c15eecf2a188 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -6733,15 +6733,15 @@ static struct ath12k *ath12k_mac_assign_vif_to_vdev(struct ieee80211_hw *hw,
 
 	mutex_lock(&ar->conf_mutex);
 
-	if (arvif->is_created)
-		goto flush;
-
 	if (vif->type == NL80211_IFTYPE_AP &&
 	    ar->num_peers > (ar->max_num_peers - 1)) {
 		ath12k_warn(ab, "failed to create vdev due to insufficient peer entry resource in firmware\n");
 		goto unlock;
 	}
 
+	if (arvif->is_created)
+		goto flush;
+
 	if (ar->num_created_vdevs > (TARGET_NUM_VDEVS - 1)) {
 		ath12k_warn(ab, "failed to create vdev, reached max vdev limit %d\n",
 			    TARGET_NUM_VDEVS);
-- 
2.50.1

[PATCH v2 4/4] sfc: fix NULL dereferences in ef100_process_design_param()

[Amelia Crate]

From: Edward Cree <ecree.xilinx@gmail.com>

[ Upstream commit 8241ecec1cdc6699ae197d52d58e76bddd995fa5 ]

Since cited commit, ef100_probe_main() and hence also
 ef100_check_design_params() run before efx->net_dev is created;
 consequently, we cannot netif_set_tso_max_size() or _segs() at this
 point.
Move those netif calls to ef100_probe_netdev(), and also replace
 netif_err within the design params code with pci_err.

Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Fixes: 98ff4c7c8ac7 ("sfc: Separate netdev probe/remove from PCI probe/remove")
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Link: https://patch.msgid.link/20250401225439.2401047-1-edward.cree@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Amelia Crate <acrate@waldn.net>
---
 drivers/net/ethernet/sfc/ef100_netdev.c |  6 ++--
 drivers/net/ethernet/sfc/ef100_nic.c    | 47 +++++++++++--------------
 2 files changed, 24 insertions(+), 29 deletions(-)

diff --git a/drivers/net/ethernet/sfc/ef100_netdev.c b/drivers/net/ethernet/sfc/ef100_netdev.c
index 7f7d560cb2b4..14dcca4ffb33 100644
--- a/drivers/net/ethernet/sfc/ef100_netdev.c
+++ b/drivers/net/ethernet/sfc/ef100_netdev.c
@@ -450,8 +450,9 @@ int ef100_probe_netdev(struct efx_probe_data *probe_data)
 	net_dev->hw_enc_features |= efx->type->offload_features;
 	net_dev->vlan_features |= NETIF_F_HW_CSUM | NETIF_F_SG |
 				  NETIF_F_HIGHDMA | NETIF_F_ALL_TSO;
-	netif_set_tso_max_segs(net_dev,
-			       ESE_EF100_DP_GZ_TSO_MAX_HDR_NUM_SEGS_DEFAULT);
+	nic_data = efx->nic_data;
+	netif_set_tso_max_size(efx->net_dev, nic_data->tso_max_payload_len);
+	netif_set_tso_max_segs(efx->net_dev, nic_data->tso_max_payload_num_segs);
 	efx->mdio.dev = net_dev;
 
 	rc = efx_ef100_init_datapath_caps(efx);
@@ -478,7 +479,6 @@ int ef100_probe_netdev(struct efx_probe_data *probe_data)
 	/* Don't fail init if RSS setup doesn't work. */
 	efx_mcdi_push_default_indir_table(efx, efx->n_rx_channels);
 
-	nic_data = efx->nic_data;
 	rc = ef100_get_mac_address(efx, net_dev->perm_addr, CLIENT_HANDLE_SELF,
 				   efx->type->is_vf);
 	if (rc)
diff --git a/drivers/net/ethernet/sfc/ef100_nic.c b/drivers/net/ethernet/sfc/ef100_nic.c
index 6da06931187d..5b1bdcac81d9 100644
--- a/drivers/net/ethernet/sfc/ef100_nic.c
+++ b/drivers/net/ethernet/sfc/ef100_nic.c
@@ -887,8 +887,7 @@ static int ef100_process_design_param(struct efx_nic *efx,
 	case ESE_EF100_DP_GZ_TSO_MAX_HDR_NUM_SEGS:
 		/* We always put HDR_NUM_SEGS=1 in our TSO descriptors */
 		if (!reader->value) {
-			netif_err(efx, probe, efx->net_dev,
-				  "TSO_MAX_HDR_NUM_SEGS < 1\n");
+			pci_err(efx->pci_dev, "TSO_MAX_HDR_NUM_SEGS < 1\n");
 			return -EOPNOTSUPP;
 		}
 		return 0;
@@ -901,32 +900,28 @@ static int ef100_process_design_param(struct efx_nic *efx,
 		 */
 		if (!reader->value || reader->value > EFX_MIN_DMAQ_SIZE ||
 		    EFX_MIN_DMAQ_SIZE % (u32)reader->value) {
-			netif_err(efx, probe, efx->net_dev,
-				  "%s size granularity is %llu, can't guarantee safety\n",
-				  reader->type == ESE_EF100_DP_GZ_RXQ_SIZE_GRANULARITY ? "RXQ" : "TXQ",
-				  reader->value);
+			pci_err(efx->pci_dev,
+				"%s size granularity is %llu, can't guarantee safety\n",
+				reader->type == ESE_EF100_DP_GZ_RXQ_SIZE_GRANULARITY ? "RXQ" : "TXQ",
+				reader->value);
 			return -EOPNOTSUPP;
 		}
 		return 0;
 	case ESE_EF100_DP_GZ_TSO_MAX_PAYLOAD_LEN:
 		nic_data->tso_max_payload_len = min_t(u64, reader->value,
 						      GSO_LEGACY_MAX_SIZE);
-		netif_set_tso_max_size(efx->net_dev,
-				       nic_data->tso_max_payload_len);
 		return 0;
 	case ESE_EF100_DP_GZ_TSO_MAX_PAYLOAD_NUM_SEGS:
 		nic_data->tso_max_payload_num_segs = min_t(u64, reader->value, 0xffff);
-		netif_set_tso_max_segs(efx->net_dev,
-				       nic_data->tso_max_payload_num_segs);
 		return 0;
 	case ESE_EF100_DP_GZ_TSO_MAX_NUM_FRAMES:
 		nic_data->tso_max_frames = min_t(u64, reader->value, 0xffff);
 		return 0;
 	case ESE_EF100_DP_GZ_COMPAT:
 		if (reader->value) {
-			netif_err(efx, probe, efx->net_dev,
-				  "DP_COMPAT has unknown bits %#llx, driver not compatible with this hw\n",
-				  reader->value);
+			pci_err(efx->pci_dev,
+				"DP_COMPAT has unknown bits %#llx, driver not compatible with this hw\n",
+				reader->value);
 			return -EOPNOTSUPP;
 		}
 		return 0;
@@ -946,10 +941,10 @@ static int ef100_process_design_param(struct efx_nic *efx,
 		 * So the value of this shouldn't matter.
 		 */
 		if (reader->value != ESE_EF100_DP_GZ_VI_STRIDES_DEFAULT)
-			netif_dbg(efx, probe, efx->net_dev,
-				  "NIC has other than default VI_STRIDES (mask "
-				  "%#llx), early probing might use wrong one\n",
-				  reader->value);
+			pci_dbg(efx->pci_dev,
+				"NIC has other than default VI_STRIDES (mask "
+				"%#llx), early probing might use wrong one\n",
+				reader->value);
 		return 0;
 	case ESE_EF100_DP_GZ_RX_MAX_RUNT:
 		/* Driver doesn't look at L2_STATUS:LEN_ERR bit, so we don't
@@ -961,9 +956,9 @@ static int ef100_process_design_param(struct efx_nic *efx,
 		/* Host interface says "Drivers should ignore design parameters
 		 * that they do not recognise."
 		 */
-		netif_dbg(efx, probe, efx->net_dev,
-			  "Ignoring unrecognised design parameter %u\n",
-			  reader->type);
+		pci_dbg(efx->pci_dev,
+			"Ignoring unrecognised design parameter %u\n",
+			reader->type);
 		return 0;
 	}
 }
@@ -999,13 +994,13 @@ static int ef100_check_design_params(struct efx_nic *efx)
 	 */
 	if (reader.state != EF100_TLV_TYPE) {
 		if (reader.state == EF100_TLV_TYPE_CONT)
-			netif_err(efx, probe, efx->net_dev,
-				  "truncated design parameter (incomplete type %u)\n",
-				  reader.type);
+			pci_err(efx->pci_dev,
+				"truncated design parameter (incomplete type %u)\n",
+				reader.type);
 		else
-			netif_err(efx, probe, efx->net_dev,
-				  "truncated design parameter %u\n",
-				  reader.type);
+			pci_err(efx->pci_dev,
+				"truncated design parameter %u\n",
+				reader.type);
 		rc = -EIO;
 	}
 out:
-- 
2.50.1