Skip to content

Commit 72897b2

Browse files
kuba-mookuba-moo
committed
Merge tag 'wireless-2023-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Johannes Berg says: ==================== Quite a collection of fixes this time, really too many to list individually. Many stack fixes, even rfkill (found by simulation and the new eevdf scheduler)! Also a bigger maintainers file cleanup, to remove old and redundant information. * tag 'wireless-2023-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (32 commits) wifi: iwlwifi: mvm: Fix incorrect usage of scan API wifi: mac80211: Create resources for disabled links wifi: cfg80211: avoid leaking stack data into trace wifi: mac80211: allow transmitting EAPOL frames with tainted key wifi: mac80211: work around Cisco AP 9115 VHT MPDU length wifi: cfg80211: Fix 6GHz scan configuration wifi: mac80211: fix potential key leak wifi: mac80211: fix potential key use-after-free wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling wifi: brcmfmac: Replace 1-element arrays with flexible arrays wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet wifi: rtw88: rtw8723d: Fix MAC address offset in EEPROM rfkill: sync before userspace visibility/changes wifi: mac80211: fix mesh id corruption on 32 bit systems wifi: cfg80211: add missing kernel-doc for cqm_rssi_work wifi: cfg80211: fix cqm_config access race wifi: iwlwifi: mvm: Fix a memory corruption issue wifi: iwlwifi: Ensure ack flag is properly cleared. wifi: iwlwifi: dbg_ini: fix structure packing iwlwifi: mvm: handle PS changes in vif_cfg_changed ... ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2 parents 1eb3dee + 22061bf commit 72897b2

File tree

30 files changed

+333
-176
lines changed

30 files changed

+333
-176
lines changed

‎MAINTAINERS

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,6 @@ F: drivers/hwmon/adm1029.c
470470
ADM8211 WIRELESS DRIVER
471471
L: [email protected]
472472
S: Orphan
473-
W: https://wireless.wiki.kernel.org/
474473
F: drivers/net/wireless/admtek/adm8211.*
475474

476475
ADP1653 FLASH CONTROLLER DRIVER
@@ -9531,10 +9530,8 @@ F: Documentation/devicetree/bindings/iio/pressure/honeywell,mprls0025pa.yaml
95319530
F: drivers/iio/pressure/mprls0025pa.c
95329531

95339532
HOST AP DRIVER
9534-
M: Jouni Malinen <[email protected]>
95359533
L: [email protected]
95369534
S: Obsolete
9537-
W: http://w1.fi/hostap-driver.html
95389535
F: drivers/net/wireless/intersil/hostap/
95399536

95409537
HP BIOSCFG DRIVER
@@ -17600,6 +17597,7 @@ M: Kalle Valo <[email protected]>
1760017597
M: Jeff Johnson <[email protected]>
1760117598
L: [email protected]
1760217599
S: Supported
17600+
W: https://wireless.wiki.kernel.org/en/users/Drivers/ath12k
1760317601
T: git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
1760417602
F: drivers/net/wireless/ath/ath12k/
1760517603

@@ -18130,8 +18128,6 @@ REALTEK WIRELESS DRIVER (rtlwifi family)
1813018128
M: Ping-Ke Shih <[email protected]>
1813118129
L: [email protected]
1813218130
S: Maintained
18133-
W: https://wireless.wiki.kernel.org/
18134-
T: git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
1813518131
F: drivers/net/wireless/realtek/rtlwifi/
1813618132

1813718133
REALTEK WIRELESS DRIVER (rtw88)
@@ -18659,22 +18655,19 @@ F: drivers/media/dvb-frontends/rtl2832_sdr*
1865918655
RTL8180 WIRELESS DRIVER
1866018656
L: [email protected]
1866118657
S: Orphan
18662-
W: https://wireless.wiki.kernel.org/
1866318658
F: drivers/net/wireless/realtek/rtl818x/rtl8180/
1866418659

1866518660
RTL8187 WIRELESS DRIVER
1866618661
M: Hin-Tak Leung <[email protected]>
1866718662
M: Larry Finger <[email protected]>
1866818663
L: [email protected]
1866918664
S: Maintained
18670-
W: https://wireless.wiki.kernel.org/
1867118665
F: drivers/net/wireless/realtek/rtl818x/rtl8187/
1867218666

1867318667
RTL8XXXU WIRELESS DRIVER (rtl8xxxu)
1867418668
M: Jes Sorensen <[email protected]>
1867518669
L: [email protected]
1867618670
S: Maintained
18677-
T: git git://git.kernel.org/pub/scm/linux/kernel/git/jes/linux.git rtl8xxxu-devel
1867818671
F: drivers/net/wireless/realtek/rtl8xxxu/
1867918672

1868018673
RTRS TRANSPORT DRIVERS
@@ -21656,7 +21649,6 @@ L: [email protected]
2165621649
S: Orphan
2165721650
W: https://wireless.wiki.kernel.org/en/users/Drivers/wl12xx
2165821651
W: https://wireless.wiki.kernel.org/en/users/Drivers/wl1251
21659-
T: git git://git.kernel.org/pub/scm/linux/kernel/git/luca/wl12xx.git
2166021652
F: drivers/net/wireless/ti/
2166121653

2166221654
TIMEKEEPING, CLOCKSOURCE CORE, NTP, ALARMTIMER

‎drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -442,7 +442,12 @@ struct brcmf_scan_params_v2_le {
442442
* fixed parameter portion is assumed, otherwise
443443
* ssid in the fixed portion is ignored
444444
*/
445-
__le16 channel_list[1]; /* list of chanspecs */
445+
union {
446+
__le16 padding; /* Reserve space for at least 1 entry for abort
447+
* which uses an on stack brcmf_scan_params_v2_le
448+
*/
449+
DECLARE_FLEX_ARRAY(__le16, channel_list); /* chanspecs */
450+
};
446451
};
447452

448453
struct brcmf_scan_results {
@@ -702,7 +707,7 @@ struct brcmf_sta_info_le {
702707

703708
struct brcmf_chanspec_list {
704709
__le32 count; /* # of entries */
705-
__le32 element[1]; /* variable length uint32 list */
710+
__le32 element[]; /* variable length uint32 list */
706711
};
707712

708713
/*

‎drivers/net/wireless/intel/iwlwifi/fw/error-dump.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -310,9 +310,9 @@ struct iwl_fw_ini_fifo_hdr {
310310
struct iwl_fw_ini_error_dump_range {
311311
__le32 range_data_size;
312312
union {
313-
__le32 internal_base_addr;
314-
__le64 dram_base_addr;
315-
__le32 page_num;
313+
__le32 internal_base_addr __packed;
314+
__le64 dram_base_addr __packed;
315+
__le32 page_num __packed;
316316
struct iwl_fw_ini_fifo_hdr fifo_hdr;
317317
struct iwl_cmd_header fw_pkt_hdr;
318318
};

‎drivers/net/wireless/intel/iwlwifi/mvm/fw.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -802,7 +802,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm)
802802
mvm->nvm_data->bands[0].n_channels = 1;
803803
mvm->nvm_data->bands[0].n_bitrates = 1;
804804
mvm->nvm_data->bands[0].bitrates =
805-
(void *)((u8 *)mvm->nvm_data->channels + 1);
805+
(void *)(mvm->nvm_data->channels + 1);
806806
mvm->nvm_data->bands[0].bitrates->hw_value = 10;
807807
}
808808

‎drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c

Lines changed: 63 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -731,73 +731,78 @@ static void iwl_mvm_mld_vif_cfg_changed_station(struct iwl_mvm *mvm,
731731

732732
mvmvif->associated = vif->cfg.assoc;
733733

734-
if (!(changes & BSS_CHANGED_ASSOC))
735-
return;
736-
737-
if (vif->cfg.assoc) {
738-
/* clear statistics to get clean beacon counter */
739-
iwl_mvm_request_statistics(mvm, true);
740-
iwl_mvm_sf_update(mvm, vif, false);
741-
iwl_mvm_power_vif_assoc(mvm, vif);
742-
743-
for_each_mvm_vif_valid_link(mvmvif, i) {
744-
memset(&mvmvif->link[i]->beacon_stats, 0,
745-
sizeof(mvmvif->link[i]->beacon_stats));
734+
if (changes & BSS_CHANGED_ASSOC) {
735+
if (vif->cfg.assoc) {
736+
/* clear statistics to get clean beacon counter */
737+
iwl_mvm_request_statistics(mvm, true);
738+
iwl_mvm_sf_update(mvm, vif, false);
739+
iwl_mvm_power_vif_assoc(mvm, vif);
740+
741+
for_each_mvm_vif_valid_link(mvmvif, i) {
742+
memset(&mvmvif->link[i]->beacon_stats, 0,
743+
sizeof(mvmvif->link[i]->beacon_stats));
744+
745+
if (vif->p2p) {
746+
iwl_mvm_update_smps(mvm, vif,
747+
IWL_MVM_SMPS_REQ_PROT,
748+
IEEE80211_SMPS_DYNAMIC, i);
749+
}
750+
751+
rcu_read_lock();
752+
link_conf = rcu_dereference(vif->link_conf[i]);
753+
if (link_conf && !link_conf->dtim_period)
754+
protect = true;
755+
rcu_read_unlock();
756+
}
746757

747-
if (vif->p2p) {
748-
iwl_mvm_update_smps(mvm, vif,
749-
IWL_MVM_SMPS_REQ_PROT,
750-
IEEE80211_SMPS_DYNAMIC, i);
758+
if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
759+
protect) {
760+
/* If we're not restarting and still haven't
761+
* heard a beacon (dtim period unknown) then
762+
* make sure we still have enough minimum time
763+
* remaining in the time event, since the auth
764+
* might actually have taken quite a while
765+
* (especially for SAE) and so the remaining
766+
* time could be small without us having heard
767+
* a beacon yet.
768+
*/
769+
iwl_mvm_protect_assoc(mvm, vif, 0);
751770
}
752771

753-
rcu_read_lock();
754-
link_conf = rcu_dereference(vif->link_conf[i]);
755-
if (link_conf && !link_conf->dtim_period)
756-
protect = true;
757-
rcu_read_unlock();
758-
}
772+
iwl_mvm_sf_update(mvm, vif, false);
773+
774+
/* FIXME: need to decide about misbehaving AP handling */
775+
iwl_mvm_power_vif_assoc(mvm, vif);
776+
} else if (iwl_mvm_mld_vif_have_valid_ap_sta(mvmvif)) {
777+
iwl_mvm_mei_host_disassociated(mvm);
759778

760-
if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
761-
protect) {
762-
/* If we're not restarting and still haven't
763-
* heard a beacon (dtim period unknown) then
764-
* make sure we still have enough minimum time
765-
* remaining in the time event, since the auth
766-
* might actually have taken quite a while
767-
* (especially for SAE) and so the remaining
768-
* time could be small without us having heard
769-
* a beacon yet.
779+
/* If update fails - SF might be running in associated
780+
* mode while disassociated - which is forbidden.
770781
*/
771-
iwl_mvm_protect_assoc(mvm, vif, 0);
782+
ret = iwl_mvm_sf_update(mvm, vif, false);
783+
WARN_ONCE(ret &&
784+
!test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
785+
&mvm->status),
786+
"Failed to update SF upon disassociation\n");
787+
788+
/* If we get an assert during the connection (after the
789+
* station has been added, but before the vif is set
790+
* to associated), mac80211 will re-add the station and
791+
* then configure the vif. Since the vif is not
792+
* associated, we would remove the station here and
793+
* this would fail the recovery.
794+
*/
795+
iwl_mvm_mld_vif_delete_all_stas(mvm, vif);
772796
}
773797

774-
iwl_mvm_sf_update(mvm, vif, false);
775-
776-
/* FIXME: need to decide about misbehaving AP handling */
777-
iwl_mvm_power_vif_assoc(mvm, vif);
778-
} else if (iwl_mvm_mld_vif_have_valid_ap_sta(mvmvif)) {
779-
iwl_mvm_mei_host_disassociated(mvm);
780-
781-
/* If update fails - SF might be running in associated
782-
* mode while disassociated - which is forbidden.
783-
*/
784-
ret = iwl_mvm_sf_update(mvm, vif, false);
785-
WARN_ONCE(ret &&
786-
!test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
787-
&mvm->status),
788-
"Failed to update SF upon disassociation\n");
789-
790-
/* If we get an assert during the connection (after the
791-
* station has been added, but before the vif is set
792-
* to associated), mac80211 will re-add the station and
793-
* then configure the vif. Since the vif is not
794-
* associated, we would remove the station here and
795-
* this would fail the recovery.
796-
*/
797-
iwl_mvm_mld_vif_delete_all_stas(mvm, vif);
798+
iwl_mvm_bss_info_changed_station_assoc(mvm, vif, changes);
798799
}
799800

800-
iwl_mvm_bss_info_changed_station_assoc(mvm, vif, changes);
801+
if (changes & BSS_CHANGED_PS) {
802+
ret = iwl_mvm_power_update_mac(mvm);
803+
if (ret)
804+
IWL_ERR(mvm, "failed to update power mode\n");
805+
}
801806
}
802807

803808
static void

‎drivers/net/wireless/intel/iwlwifi/mvm/scan.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2342,7 +2342,7 @@ iwl_mvm_scan_umac_fill_general_p_v12(struct iwl_mvm *mvm,
23422342
if (gen_flags & IWL_UMAC_SCAN_GEN_FLAGS_V2_FRAGMENTED_LMAC2)
23432343
gp->num_of_fragments[SCAN_HB_LMAC_IDX] = IWL_SCAN_NUM_OF_FRAGS;
23442344

2345-
if (version < 12) {
2345+
if (version < 16) {
23462346
gp->scan_start_mac_or_link_id = scan_vif->id;
23472347
} else {
23482348
struct iwl_mvm_vif_link_info *link_info;

‎drivers/net/wireless/intel/iwlwifi/mvm/tx.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1612,6 +1612,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
16121612
iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
16131613

16141614
memset(&info->status, 0, sizeof(info->status));
1615+
info->flags &= ~(IEEE80211_TX_STAT_ACK | IEEE80211_TX_STAT_TX_FILTERED);
16151616

16161617
/* inform mac80211 about what happened with the frame */
16171618
switch (status & TX_STATUS_MSK) {
@@ -1964,6 +1965,8 @@ static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,
19641965
*/
19651966
if (!is_flush)
19661967
info->flags |= IEEE80211_TX_STAT_ACK;
1968+
else
1969+
info->flags &= ~IEEE80211_TX_STAT_ACK;
19671970
}
19681971

19691972
/*

‎drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -918,9 +918,17 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
918918

919919
mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:",
920920
event_buf, len);
921-
while (tlv_buf_left >= sizeof(*tlv_rxba)) {
921+
while (tlv_buf_left > sizeof(*tlv_rxba)) {
922922
tlv_type = le16_to_cpu(tlv_rxba->header.type);
923923
tlv_len = le16_to_cpu(tlv_rxba->header.len);
924+
if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {
925+
mwifiex_dbg(priv->adapter, WARN,
926+
"TLV size (%zu) overflows event_buf buf_left=%d\n",
927+
size_add(sizeof(tlv_rxba->header), tlv_len),
928+
tlv_buf_left);
929+
return;
930+
}
931+
924932
if (tlv_type != TLV_TYPE_RXBA_SYNC) {
925933
mwifiex_dbg(priv->adapter, ERROR,
926934
"Wrong TLV id=0x%x\n", tlv_type);
@@ -929,6 +937,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
929937

930938
tlv_seq_num = le16_to_cpu(tlv_rxba->seq_num);
931939
tlv_bitmap_len = le16_to_cpu(tlv_rxba->bitmap_len);
940+
if (size_add(sizeof(*tlv_rxba), tlv_bitmap_len) > tlv_buf_left) {
941+
mwifiex_dbg(priv->adapter, WARN,
942+
"TLV size (%zu) overflows event_buf buf_left=%d\n",
943+
size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
944+
tlv_buf_left);
945+
return;
946+
}
947+
932948
mwifiex_dbg(priv->adapter, INFO,
933949
"%pM tid=%d seq_num=%d bitmap_len=%d\n",
934950
tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
@@ -965,8 +981,8 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
965981
}
966982
}
967983

968-
tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
969-
tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
984+
tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
985+
tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len;
970986
tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
971987
}
972988
}

‎drivers/net/wireless/marvell/mwifiex/fw.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -779,7 +779,7 @@ struct mwifiex_ie_types_rxba_sync {
779779
u8 reserved;
780780
__le16 seq_num;
781781
__le16 bitmap_len;
782-
u8 bitmap[1];
782+
u8 bitmap[];
783783
} __packed;
784784

785785
struct chan_band_param_set {

‎drivers/net/wireless/marvell/mwifiex/sta_rx.c

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,8 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
8686
rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length);
8787
rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off;
8888

89-
if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) {
89+
if (sizeof(rx_pkt_hdr->eth803_hdr) + sizeof(rfc1042_header) +
90+
rx_pkt_off > skb->len) {
9091
mwifiex_dbg(priv->adapter, ERROR,
9192
"wrong rx packet offset: len=%d, rx_pkt_off=%d\n",
9293
skb->len, rx_pkt_off);
@@ -95,12 +96,13 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
9596
return -1;
9697
}
9798

98-
if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
99-
sizeof(bridge_tunnel_header))) ||
100-
(!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
101-
sizeof(rfc1042_header)) &&
102-
ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP &&
103-
ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX)) {
99+
if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len &&
100+
((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
101+
sizeof(bridge_tunnel_header))) ||
102+
(!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
103+
sizeof(rfc1042_header)) &&
104+
ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP &&
105+
ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX))) {
104106
/*
105107
* Replace the 803 header and rfc1042 header (llc/snap) with an
106108
* EthernetII header, keep the src/dst and snap_type

0 commit comments

Comments
 (0)