From nobody Sun Apr 5 13:06:23 2026 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 95CAF2BD030; Fri, 20 Feb 2026 09:47:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=83.149.199.84 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771580879; cv=none; b=pMg6VBXPq+MzIJxRRCjnCIQbw47hSTPws93knMYLY8ZOfCGL1c+ZptnI97NufIoX4Dm0edu8sfSaybhca0hGIkof07lQuv9cgQIuYx81c/5yzkFHVxy9ImdEGUvTySQ0Xi5JTyAsVEC2f4XuE2tN8yIwT8erYruotIxDG+BCG7I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771580879; c=relaxed/simple; bh=LDXix9PN0IinDABVv8UkHXsICzMk77zfNM7DbdoMYVA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qKfaDRhoW3GkB4hAvK++LBIZC4LwPUFg81F2+LwtOKQt0PeN7GKcNTZnF79AmOWhrcsAvwPUMOnKmJALDkpB+CvCx1PFqAS9VXp0SMgypNclhfh8JG5bKNdJXA5cA0foXDxI1+nx73h+kgye0tF8/2ppyCr+g3eMMp/yR3bGops= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ispras.ru; spf=pass smtp.mailfrom=ispras.ru; dkim=pass (1024-bit key) header.d=ispras.ru header.i=@ispras.ru header.b=khMD/SJz; arc=none smtp.client-ip=83.149.199.84 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ispras.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ispras.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ispras.ru header.i=@ispras.ru header.b="khMD/SJz" Received: from debian.lan (unknown [79.139.245.7]) by mail.ispras.ru (Postfix) with ESMTPSA id 746B440ACE0A; Fri, 20 Feb 2026 09:47:47 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 746B440ACE0A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1771580867; bh=uv2nVANfS7S6tqJoCX4h4dxXBtr6Gdnxmxsiz6IGxtc=; h=From:To:Cc:Subject:Date:From; b=khMD/SJz+Y3W9A/u4yhh7yzz9jtxXADq4YgWLZxModnOdqATzkUfjev/6O61BdveO MNIEwvSDKyUCCJSFVAovu9GAwxbWqDr8huV/SzUELfPY5J8nbPSsiDaqkRwm5tmpB2 kcb/SZNT1hxyECrplJI0qjy8w506FZ2LIo4582jE= From: Fedor Pchelkin To: Ping-Ke Shih Cc: Fedor Pchelkin , Jian-Hong Pan , Kalle Valo , Kai-Heng Feng , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Bitterblue Smith , Dmitry Antipov , lvc-project@linuxtesting.org, stable@vger.kernel.org Subject: [PATCH rtw-next] wifi: rtw88: check for PCI upstream bridge existence Date: Fri, 20 Feb 2026 12:47:30 +0300 Message-ID: <20260220094730.49791-1-pchelkin@ispras.ru> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" pci_upstream_bridge() returns NULL if the device is on a root bus. If 8821CE is installed in the system with such a PCI topology, the probing routine will crash. This has probably been unnoticed as 8821CE is mostly supplied in laptops where there is a PCI-to-PCI bridge located upstream from the device. However the card might be installed on a system with different configuration. Check if the bridge does exist for the specific workaround to be applied. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. Fixes: 24f5e38a13b5 ("rtw88: Disable PCIe ASPM while doing NAPI poll on 882= 1CE") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Acked-by: Ping-Ke Shih --- I don't have 8821CE but 8822CE instead and I've been able to reproduce the NULL bridge pointer dereference with rtwdev->chip->id manually adjusted in the workaround. Wifi devices happen to be located on a root bus in most of the systems I have access to. drivers/net/wireless/realtek/rtw88/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireles= s/realtek/rtw88/pci.c index 56b16186d3aa..ec0a45bfb670 100644 --- a/drivers/net/wireless/realtek/rtw88/pci.c +++ b/drivers/net/wireless/realtek/rtw88/pci.c @@ -1804,7 +1804,8 @@ int rtw_pci_probe(struct pci_dev *pdev, } =20 /* Disable PCIe ASPM L1 while doing NAPI poll for 8821CE */ - if (rtwdev->chip->id =3D=3D RTW_CHIP_TYPE_8821C && bridge->vendor =3D=3D = PCI_VENDOR_ID_INTEL) + if (rtwdev->chip->id =3D=3D RTW_CHIP_TYPE_8821C && + bridge && bridge->vendor =3D=3D PCI_VENDOR_ID_INTEL) rtwpci->rx_no_aspm =3D true; =20 rtw_pci_phy_cfg(rtwdev); --=20 2.51.0