Merge branch 'staging-linus' into branch 'staging-next'

There were merge conflicts in:
	drivers/staging/rtl8723bs/core/rtw_ieee80211.c
	drivers/staging/sm750fb/sm750_hw.c

that were causing problems, so fix this up in here so that going forward
everyone is on the same page and linux-next does not have problems.

Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Greg Kroah-Hartman 2026-02-25 07:15:08 -08:00
commit 2f0dad8baa
4 changed files with 26 additions and 17 deletions

View File

@ -186,20 +186,25 @@ u8 *rtw_get_ie_ex(u8 *in_ie, uint in_len, u8 eid, u8 *oui, u8 oui_len, u8 *ie, u
cnt = 0;
while (cnt < in_len) {
while (cnt + 2 <= in_len) {
u8 ie_len = in_ie[cnt + 1];
if (cnt + 2 + ie_len > in_len)
break;
if (eid == in_ie[cnt] &&
(!oui || !memcmp(&in_ie[cnt + 2], oui, oui_len))) {
(!oui || (ie_len >= oui_len && !memcmp(&in_ie[cnt + 2], oui, oui_len)))) {
target_ie = &in_ie[cnt];
if (ie)
memcpy(ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
memcpy(ie, &in_ie[cnt], ie_len + 2);
if (ielen)
*ielen = in_ie[cnt + 1] + 2;
*ielen = ie_len + 2;
break;
}
cnt += in_ie[cnt + 1] + 2; /* goto next */
cnt += ie_len + 2; /* goto next */
}
return target_ie;

View File

@ -1988,7 +1988,10 @@ int rtw_restruct_wmm_ie(struct adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_
while (i < in_len) {
ielength = initial_out_len;
if (in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 && in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 && in_ie[i + 5] == 0x02 && i + 5 < in_len) { /* WMM element ID and OUI */
if (i + 5 < in_len &&
in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 &&
in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 &&
in_ie[i + 5] == 0x02) {
for (j = i; j < i + 9; j++) {
out_ie[ielength] = in_ie[j];
ielength++;

View File

@ -1058,6 +1058,7 @@ static void lynxfb_pci_remove(struct pci_dev *pdev)
iounmap(sm750_dev->pvReg);
iounmap(sm750_dev->pvMem);
pci_release_region(pdev, 1);
kfree(g_settings);
}

View File

@ -34,16 +34,11 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
sm750_dev->vidreg_start = pci_resource_start(pdev, 1);
sm750_dev->vidreg_size = SZ_2M;
/*
* reserve the vidreg space of smi adaptor
* if you do this, you need to add release region code
* in lynxfb_remove, or memory will not be mapped again
* successfully
*/
/* reserve the vidreg space of smi adaptor */
ret = pci_request_region(pdev, 1, "sm750fb");
if (ret) {
dev_err(&pdev->dev, "Can not request PCI regions.\n");
goto exit;
return ret;
}
/* now map mmio and vidmem */
@ -52,7 +47,7 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
if (!sm750_dev->pvReg) {
dev_err(&pdev->dev, "mmio failed\n");
ret = -EFAULT;
goto exit;
goto err_release_region;
}
sm750_dev->accel.dpr_base = sm750_dev->pvReg + DE_BASE_ADDR_TYPE1;
@ -74,12 +69,17 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
sm750_dev->pvMem =
ioremap_wc(sm750_dev->vidmem_start, sm750_dev->vidmem_size);
if (!sm750_dev->pvMem) {
iounmap(sm750_dev->pvReg);
dev_err(&pdev->dev, "Map video memory failed\n");
ret = -EFAULT;
goto exit;
goto err_unmap_reg;
}
exit:
return 0;
err_unmap_reg:
iounmap(sm750_dev->pvReg);
err_release_region:
pci_release_region(pdev, 1);
return ret;
}