Pull staging driver updates from Greg KH:
 "Here is the big set of staging driver updates for 6.19-rc1.

  Only thing "major" in here is that two subsystems, gpib and vc04 have
  moved out of the staging tree into the "real" portion of the kernel,
  which is great to see. Other than that, the rest of the changes are
  just tiny coding style cleanups, nothing earth-shattering.

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'staging-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (53 commits)
  staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
  staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
  staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
  staging: gpib: Clean-up commented-out code
  staging: rtl8723bs: remove custom FIELD_OFFSET macro
  staging: rtl8723bs: replace FIELD_OFFSET usage with offsetof in rtw_mlme_ext.c
  staging: rtl8723bs: remove dead commented code from odm.c
  staging: rtl8723bs: use standard offsetof in cfg80211 operations
  staging: rtl8723bs: remove unused registry and BSSID offset macros
  staging: rtl8723bs: core: delete commented-out code
  staging: rtl8723bs: core: fix block comment style issues
  staging: greybus: uart: check return values during probe
  staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
  staging: gpib: Destage gpib
  staging: gpib: Fix SPDX license for gpib headers
  staging: gpib: Update TODO file
  staging: gpib: Change // comments in uapi header file
  platform/raspberrypi: Destage VCHIQ MMAL driver
  platform/raspberrypi: Destage VCHIQ interface
  staging: vc04_services: Cleanup VCHIQ TODO entries
  ...

Pull char/misc/IIO driver updates from Greg KH:
 "Here is the big set of char/misc/iio driver updates for 6.19-rc1. Lots
  of stuff in here including:

   - lots of IIO driver updates, cleanups, and additions

   - large interconnect driver changes as they get converted over to a
     dynamic system of ids

   - coresight driver updates

   - mwave driver updates

   - binder driver updates and changes

   - comedi driver fixes now that the fuzzers are being set loose on
     them

   - nvmem driver updates

   - new uio driver addition

   - lots of other small char/misc driver updates, full details in the
     shortlog

  All of these have been in linux-next for a while now"

* tag 'char-misc-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (304 commits)
  char: applicom: fix NULL pointer dereference in ac_ioctl
  hangcheck-timer: fix coding style spacing
  hangcheck-timer: Replace %Ld with %lld
  hangcheck-timer: replace printk(KERN_CRIT) with pr_crit
  uio: Add SVA support for PCI devices via uio_pci_generic_sva.c
  dt-bindings: slimbus: fix warning from example
  intel_th: Fix error handling in intel_th_output_open
  misc: rp1: Fix an error handling path in rp1_probe()
  char: xillybus: add WQ_UNBOUND to alloc_workqueue users
  misc: bh1770glc: use pm_runtime_resume_and_get() in power_state_store
  misc: cb710: Fix a NULL vs IS_ERR() check in probe()
  mux: mmio: Add suspend and resume support
  virt: acrn: split acrn_mmio_dev_res out of acrn_mmiodev
  greybus: gb-beagleplay: Fix timeout handling in bootloader functions
  greybus: add WQ_PERCPU to alloc_workqueue users
  char/mwave: drop typedefs
  char/mwave: drop printk wrapper
  char/mwave: remove printk tracing
  char/mwave: remove unneeded fops
  char/mwave: remove MWAVE_FUTZ_WITH_OTHER_DEVICES ifdeffery
  ...

Pull sound updates from Takashi Iwai:
 "The majority of changes at this time were about ASoC with a lot of
  code refactoring works. From the functionality POV, there isn't much
  to see, but we have a wide range of device-specific fixes and updates.
  Here are some highlights:

   - Continued ASoC API cleanup work, spanned over many files

   - Added a SoundWire SCDA generic class driver with regmap support

   - Enhancements and fixes for Cirrus, Intel, Maxim and Qualcomm.

   - Support for ASoC Allwinner A523, Mediatek MT8189, Qualcomm QCM2290,
     QRB2210 and SM6115, SpacemiT K1, and TI TAS2568, TAS5802, TAS5806,
     TAS5815, TAS5828 and TAS5830

   - Usual HD-audio and USB-audio quirks and fixups

   - Support for Onkyo SE-300PCIE, TASCAM IF-FW/DM MkII

  Some gpiolib changes for shared GPIOs are included along with this PR
  for covering ASoC drivers changes"

* tag 'sound-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (739 commits)
  ALSA: hda/realtek: Add PCI SSIDs to HP ProBook quirks
  ALSA: usb-audio: Simplify with usb_endpoint_max_periodic_payload()
  ALSA: hda/realtek: fix mute/micmute LEDs don't work for more HP laptops
  ALSA: rawmidi: Fix inconsistent indenting warning reported by smatch
  ALSA: dice: fix buffer overflow in detect_stream_formats()
  ASoC: codecs: Modify awinic amplifier dsp read and write functions
  ASoC: SDCA: Fixup some more Kconfig issues
  ASoC: cs35l56: Log a message if firmware is missing
  ASoC: nau8325: Delete a stray tab
  firmware: cs_dsp: Add test cases for client_ops == NULL
  firmware: cs_dsp: Don't require client to provide a struct cs_dsp_client_ops
  ASoC: fsl_micfil: Set channel range control
  ASoC: fsl_micfil: Add default quality for different platforms
  ASoC: intel: sof_sdw: Add codec_info for cs42l45
  ASoC: sdw_utils: Add cs42l45 support functions
  ASoC: intel: sof_sdw: Add ability to have auxiliary devices
  ASoC: sdw_utils: Move codec_name to dai info
  ASoC: sdw_utils: Add codec_conf for every DAI
  ASoC: SDCA: Add terminal type into input/output widget name
  ASoC: SDCA: Align mute controls to ALSA expectations
  ...

Pull media updates from Mauro Carvalho Chehab:

 - New drivers:
    - Mali-C55 ISP
    - Rockchip VICAP (RKCIF)
    - RKVDEC HEVC Decoder
    - Renesas RZV2H IVC
    - Sony IMX111 CMOS sensor driver

 - Removed STi C8SECTPFE Driver

 - Added a V4L2 ISP generic framework

 - Usual set of cleanup, fixes and driver improvements

* tag 'media/v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (249 commits)
  media: rockchip: rkcif: add support for rk3568 vicap mipi capture
  media: rockchip: rkcif: add support for rk3568 vicap dvp capture
  media: rockchip: rkcif: add support for px30 vip dvp capture
  media: rockchip: rkcif: add abstraction for dma blocks
  media: rockchip: rkcif: add abstraction for interface and crop blocks
  media: rockchip: add driver for the rockchip camera interface
  media: dt-bindings: add rockchip rk3568 vicap
  media: dt-bindings: add rockchip px30 vip
  media: dt-bindings: video-interfaces: add defines for sampling modes
  Documentation: admin-guide: media: add rockchip camera interface
  media: mali-c55: Mark pm handlers as __maybe_unused
  media: mali-c55: Assert ISP blocks size correctness
  media: v4l2-isp: Rename block_info to block_type_info
  MAINTAINERS: Add entry for rzv2h-ivc driver
  media: platform: Add Renesas Input Video Control block driver
  dt-bindings: media: Add bindings for the RZ/V2H(P) IVC block
  Documentation: media: mali-c55: Document the mali-c55 parameter setting
  media: platform: Add mali-c55 parameters video node
  media: uapi: Add parameters structs to mali-c55-config.h
  media: mali-c55: Add image formats for Mali-C55 parameters buffer
  ...

Pull printk updates from Petr Mladek:

 - Allow creaing nbcon console drivers with an unsafe write_atomic()
   callback that can only be called by the final nbcon_atomic_flush_unsafe().
   Otherwise, the driver would rely on the kthread.

   It is going to be used as the-best-effort approach for an
   experimental nbcon netconsole driver, see

     https://lore.kernel.org/r/20251121-nbcon-v1-2-503d17b2b4af@debian.org

   Note that a safe .write_atomic() callback is supposed to work in NMI
   context. But some networking drivers are not safe even in IRQ
   context:

     https://lore.kernel.org/r/oc46gdpmmlly5o44obvmoatfqo5bhpgv7pabpvb6sjuqioymcg@gjsma3ghoz35

   In an ideal world, all networking drivers would be fixed first and
   the atomic flush would be blocked only in NMI context. But it brings
   the question how reliable networking drivers are when the system is
   in a bad state. They might block flushing more reliable serial
   consoles which are more suitable for serious debugging anyway.

 - Allow to use the last 4 bytes of the printk ring buffer.

 - Prevent queuing IRQ work and block printk kthreads when consoles are
   suspended. Otherwise, they create non-necessary churn or even block
   the suspend.

 - Release console_lock() between each record in the kthread used for
   legacy consoles on RT. It might significantly speed up the boot.

 - Release nbcon context between each record in the atomic flush. It
   prevents stalls of the related printk kthread after it has lost the
   ownership in the middle of a record

 - Add support for NBCON consoles into KDB

 - Add %ptsP modifier for printing struct timespec64 and use it where
   possible

 - Misc code clean up

* tag 'printk-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: (48 commits)
  printk: Use console_is_usable on console_unblank
  arch: um: kmsg_dump: Use console_is_usable
  drivers: serial: kgdboc: Drop checks for CON_ENABLED and CON_BOOT
  lib/vsprintf: Unify FORMAT_STATE_NUM handlers
  printk: Avoid irq_work for printk_deferred() on suspend
  printk: Avoid scheduling irq_work on suspend
  printk: Allow printk_trigger_flush() to flush all types
  tracing: Switch to use %ptSp
  scsi: snic: Switch to use %ptSp
  scsi: fnic: Switch to use %ptSp
  s390/dasd: Switch to use %ptSp
  ptp: ocp: Switch to use %ptSp
  pps: Switch to use %ptSp
  PCI: epf-test: Switch to use %ptSp
  net: dsa: sja1105: Switch to use %ptSp
  mmc: mmc_test: Switch to use %ptSp
  media: av7110: Switch to use %ptSp
  ipmi: Switch to use %ptSp
  igb: Switch to use %ptSp
  e1000e: Switch to use %ptSp
  ...

The Extended Supported Rates (ESR) IE handling in OnBeacon accessed
*(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these
offsets lie within the received frame buffer. A malformed beacon with
an ESR IE positioned at the end of the buffer could cause an
out-of-bounds read, potentially triggering a kernel panic.

Add a boundary check to ensure that the ESR IE body and the subsequent
bytes are within the limits of the frame before attempting to access
them.

This prevents OOB reads caused by malformed beacon frames.

Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The Supported Rates IE length from an incoming Association Request frame
was used directly as the memcpy() length when copying into a fixed-size
16-byte stack buffer (supportRate). A malicious station can advertise an
IE length larger than 16 bytes, causing a stack buffer overflow.

Clamp ie_len to the buffer size before copying the Supported Rates IE,
and correct the bounds check when merging Extended Supported Rates to
prevent a second potential overflow.

This prevents kernel stack corruption triggered by malformed association
requests.

Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The Information Element (IE) parser rtw_get_ie() trusted the length
byte of each IE without validating that the IE body (len bytes after
the 2-byte header) fits inside the remaining frame buffer. A malformed
frame can advertise an IE length larger than the available data, causing
the parser to increment its pointer beyond the buffer end. This results
in out-of-bounds reads or, depending on the pattern, an infinite loop.

Fix by validating that (offset + 2 + len) does not exceed the limit
before accepting the IE or advancing to the next element.

This prevents OOB reads and ensures the parser terminates safely on
malformed frames.

Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The custom FIELD_OFFSET macro is no longer used in the driver (replaced
by standard offsetof). Remove the definition.

Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20251125112059.16913-6-knavaneeth786@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Replace usage of the custom FIELD_OFFSET macro with the standard
offsetof() macro in rtw_mlme_ext.c. This improves code readability
and uses the kernel's standard mechanism.

Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20251125112059.16913-5-knavaneeth786@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>