From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9289D347FCC; Sat, 28 Feb 2026 17:37:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300237; cv=none; b=Yd2nFgFfQePqu2UuQzc4zXTq/vJRSkQLunozBd0I4I6zU4WV7p0vBot5LYsaYsU7lD1dwHh7KNFdn8Tmfe8wBmYRtZXpNxcxNpBcx+qH+ToWWuxm6DcPdqF3bc+r0aFjd3uNoSw7CetilHaOm52fPkwVGV8GUV8y8RuflR8mkl0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300237; c=relaxed/simple; bh=awD29nvx2aphOkit+4HOtUSGi40fwC+8DL/sgkv8urc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OfZr3A0zfGVbFZXmFcWHx4yQ/y1TxJDQKACTNGYDUHobGpRgwmOGdqetSinJtYtD/cH5a6e0sEhI4S0PSaNSbxXzKmU79CLHDu1JoJ4CaAhAmIVissY/5x23GcSvmMk/GMCJF2aqmItGUNYalb8Q2UVaOPT+HldycEgazZhXazs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=rSBh/ovp; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="rSBh/ovp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF21EC19425; Sat, 28 Feb 2026 17:37:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772300237; bh=awD29nvx2aphOkit+4HOtUSGi40fwC+8DL/sgkv8urc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rSBh/ovpr2/PF5kPXWO8w9r75am40nOCgNUAUHVWLaE/tSDA83BWhKap/pKoyIjHO tP7TewFEKJnkBVqRILZOEmtsB6QK9/23jBAhMqaGPQ/7TKvlXTuEOuz9u/o23prYsb EUg6VJ2PrLyj4+RqKxtHLp7bgMtJqD3kgMCzS3I8aGK9lCt1fKWgTm16XsrvpM4leV HlGtprjvC7mozEWTGDgTXarEmSgrMpArEtMGvvyZ46mt2KUcyqQaAWjG750kbDrrmy HkiuxP0TQWFnXMYaUpscWMvNfC0pbjYY+THPLXG99DgUzj1CBLaP6N7ocIYu5GmIq6 V85IWnh0cNK4A== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Bitterblue Smith , Ping-Ke Shih , Sasha Levin Subject: [PATCH 6.19 260/844] wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data Date: Sat, 28 Feb 2026 12:22:53 -0500 Message-ID: <20260228173244.1509663-261-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org> References: <20260228173244.1509663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Bitterblue Smith [ Upstream commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82 ] Internally wiphy writes to individual channels in this structure, so we must not share one static definition of channel list between multiple device instances, because that causes hard to debug breakage. For example, with two rtw88 driven devices in the system, channel information may get incoherent, preventing channel use. Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing of struct ieee80211_supported_band data"). Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com Signed-off-by: Sasha Levin --- drivers/net/wireless/realtek/rtw88/main.c | 34 +++++++++++++++++++---- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c index 6f35357e73246..dde2ea6a00e06 100644 --- a/drivers/net/wireless/realtek/rtw88/main.c +++ b/drivers/net/wireless/realtek/rtw88/main.c @@ -1658,16 +1658,41 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev) return len; } +static struct ieee80211_supported_band * +rtw_sband_dup(struct rtw_dev *rtwdev, + const struct ieee80211_supported_band *sband) +{ + struct ieee80211_supported_band *dup; + + dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL); + if (!dup) + return NULL; + + dup->channels = devm_kmemdup_array(rtwdev->dev, sband->channels, + sband->n_channels, + sizeof(*sband->channels), + GFP_KERNEL); + if (!dup->channels) + return NULL; + + dup->bitrates = devm_kmemdup_array(rtwdev->dev, sband->bitrates, + sband->n_bitrates, + sizeof(*sband->bitrates), + GFP_KERNEL); + if (!dup->bitrates) + return NULL; + + return dup; +} + static void rtw_set_supported_band(struct ieee80211_hw *hw, const struct rtw_chip_info *chip) { struct ieee80211_supported_band *sband; struct rtw_dev *rtwdev = hw->priv; - struct device *dev = rtwdev->dev; if (chip->band & RTW_BAND_2G) { - sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband), - GFP_KERNEL); + sband = rtw_sband_dup(rtwdev, &rtw_band_2ghz); if (!sband) goto err_out; if (chip->ht_supported) @@ -1676,8 +1701,7 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw, } if (chip->band & RTW_BAND_5G) { - sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband), - GFP_KERNEL); + sband = rtw_sband_dup(rtwdev, &rtw_band_5ghz); if (!sband) goto err_out; if (chip->ht_supported) -- 2.51.0