leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wireless fixes for v5.19

Browse Source 
First set of fixes for v5.19. Build fixes for iwlwifi and libertas, a
 scheduling while atomic fix for rtw88 and use-after-free fix for
 mac80211.
 -----BEGIN PGP SIGNATURE-----
 
 iQFFBAABCgAvFiEEiBjanGPFTz4PRfLobhckVSbrbZsFAmKXSCgRHGt2YWxvQGtl
 cm5lbC5vcmcACgkQbhckVSbrbZvWpAf9G7EudAQVOCfP4ogJ89m60U5S3ui4HbSG
 5hyTwxUnzdrngYmykSEOsChX4inhZOPGiGBD1652sy82NQpD6e8lxRsBQUQeb8lm
 RTn4PBY9sWVJo7Qe1oLXLv6yKApAdiUlVtWJNZDjotOZUxd7KubCQWcTz4lNQ/Mu
 AG5zvWuCDP+McY9r6rqwhI3+ql/gsewbcONHd9nZufQMydDtxE39lk5GKFvPJgg2
 F6sAYPP/O243nVDUOmg73NrnlU+2tWwamCUp8v4dSlQpfXRd+G65k5AKruz5AXmJ
 zQ9rQkCe1aCvyPOtRa6Q2uAsi553NaCDudHHRgxV8+qP7phXWOpV/g==
 =Cly8
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2022-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Kalle Valo says:

====================
wireless fixes for v5.19

First set of fixes for v5.19. Build fixes for iwlwifi and libertas, a
scheduling while atomic fix for rtw88 and use-after-free fix for
mac80211.

* tag 'wireless-2022-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: mac80211: fix use-after-free in chanctx code
  wifi: rtw88: add a work to correct atomic scheduling warning of ::set_tim
  wifi: iwlwifi: pcie: rename CAUSE macro
  wifi: libertas: use variable-size data in assoc req/resp cmd
====================

Link: https://lore.kernel.org/r/20220601110741.90B28C385A5@smtp.kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2022-06-01 17:34:22 -07:00
commit 38a4762e4b
9 changed files with 39 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/net/wireless/intel/iwlwifi/pcie/trans.c
View File

@ -1090,7 +1090,7 @@ struct iwl_causes_list {
u8 addr; u8 addr;
}; };
#define CAUSE(reg, mask) \ #define IWL_CAUSE(reg, mask) \
{ \ { \
.mask_reg = reg, \ .mask_reg = reg, \
.bit = ilog2(mask), \ .bit = ilog2(mask), \
@ -1101,28 +1101,28 @@ struct iwl_causes_list {
} }
static const struct iwl_causes_list causes_list_common[] = { static const struct iwl_causes_list causes_list_common[] = {
CAUSE(CSR_MSIX_FH_INT_MASK_AD, MSIX_FH_INT_CAUSES_D2S_CH0_NUM), IWL_CAUSE(CSR_MSIX_FH_INT_MASK_AD, MSIX_FH_INT_CAUSES_D2S_CH0_NUM),
CAUSE(CSR_MSIX_FH_INT_MASK_AD, MSIX_FH_INT_CAUSES_D2S_CH1_NUM), IWL_CAUSE(CSR_MSIX_FH_INT_MASK_AD, MSIX_FH_INT_CAUSES_D2S_CH1_NUM),
CAUSE(CSR_MSIX_FH_INT_MASK_AD, MSIX_FH_INT_CAUSES_S2D), IWL_CAUSE(CSR_MSIX_FH_INT_MASK_AD, MSIX_FH_INT_CAUSES_S2D),
CAUSE(CSR_MSIX_FH_INT_MASK_AD, MSIX_FH_INT_CAUSES_FH_ERR), IWL_CAUSE(CSR_MSIX_FH_INT_MASK_AD, MSIX_FH_INT_CAUSES_FH_ERR),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_ALIVE), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_ALIVE),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_WAKEUP), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_WAKEUP),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_RESET_DONE), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_RESET_DONE),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_CT_KILL), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_CT_KILL),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_RF_KILL), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_RF_KILL),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_PERIODIC), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_PERIODIC),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_SCD), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_SCD),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_FH_TX), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_FH_TX),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_HW_ERR), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_HW_ERR),
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_HAP), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_HAP),
}; };
static const struct iwl_causes_list causes_list_pre_bz[] = { static const struct iwl_causes_list causes_list_pre_bz[] = {
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_SW_ERR), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_SW_ERR),
}; };
static const struct iwl_causes_list causes_list_bz[] = { static const struct iwl_causes_list causes_list_bz[] = {
CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_SW_ERR_BZ), IWL_CAUSE(CSR_MSIX_HW_INT_MASK_AD, MSIX_HW_INT_CAUSES_REG_SW_ERR_BZ),
}; };
static void iwl_pcie_map_list(struct iwl_trans *trans, static void iwl_pcie_map_list(struct iwl_trans *trans,

4
drivers/net/wireless/marvell/libertas/cfg.c
View File

@ -1053,7 +1053,6 @@ static int lbs_set_authtype(struct lbs_private *priv,
*/ */
#define LBS_ASSOC_MAX_CMD_SIZE \ #define LBS_ASSOC_MAX_CMD_SIZE \
(sizeof(struct cmd_ds_802_11_associate) \ (sizeof(struct cmd_ds_802_11_associate) \
- 512 /* cmd_ds_802_11_associate.iebuf */ \
+ LBS_MAX_SSID_TLV_SIZE \ + LBS_MAX_SSID_TLV_SIZE \
+ LBS_MAX_CHANNEL_TLV_SIZE \ + LBS_MAX_CHANNEL_TLV_SIZE \
+ LBS_MAX_CF_PARAM_TLV_SIZE \ + LBS_MAX_CF_PARAM_TLV_SIZE \
@ -1130,8 +1129,7 @@ static int lbs_associate(struct lbs_private *priv,
if (sme->ie && sme->ie_len) if (sme->ie && sme->ie_len)
pos += lbs_add_wpa_tlv(pos, sme->ie, sme->ie_len); pos += lbs_add_wpa_tlv(pos, sme->ie, sme->ie_len);
len = (sizeof(*cmd) - sizeof(cmd->iebuf)) + len = sizeof(*cmd) + (u16)(pos - (u8 *) &cmd->iebuf);
(u16)(pos - (u8 *) &cmd->iebuf);
cmd->hdr.size = cpu_to_le16(len); cmd->hdr.size = cpu_to_le16(len);
lbs_deb_hex(LBS_DEB_ASSOC, "ASSOC_CMD", (u8 *) cmd, lbs_deb_hex(LBS_DEB_ASSOC, "ASSOC_CMD", (u8 *) cmd,

6
drivers/net/wireless/marvell/libertas/host.h
View File

@ -528,7 +528,8 @@ struct cmd_ds_802_11_associate {
__le16 listeninterval; __le16 listeninterval;
__le16 bcnperiod; __le16 bcnperiod;
u8 dtimperiod; u8 dtimperiod;
u8 iebuf[512]; /* Enough for required and most optional IEs */ /* 512 permitted - enough for required and most optional IEs */
u8 iebuf[];
} __packed; } __packed;
struct cmd_ds_802_11_associate_response { struct cmd_ds_802_11_associate_response {
@ -537,7 +538,8 @@ struct cmd_ds_802_11_associate_response {
__le16 capability; __le16 capability;
__le16 statuscode; __le16 statuscode;
__le16 aid; __le16 aid;
u8 iebuf[512]; /* max 512 */
u8 iebuf[];
} __packed; } __packed;
struct cmd_ds_802_11_set_wep { struct cmd_ds_802_11_set_wep {

10
drivers/net/wireless/realtek/rtw88/fw.c
View File

@ -1602,6 +1602,16 @@ free:
return ret; return ret;
} }
void rtw_fw_update_beacon_work(struct work_struct *work)
{
struct rtw_dev *rtwdev = container_of(work, struct rtw_dev,
update_beacon_work);
mutex_lock(&rtwdev->mutex);
rtw_fw_download_rsvd_page(rtwdev);
mutex_unlock(&rtwdev->mutex);
}
static void rtw_fw_read_fifo_page(struct rtw_dev *rtwdev, u32 offset, u32 size, static void rtw_fw_read_fifo_page(struct rtw_dev *rtwdev, u32 offset, u32 size,
u32 *buf, u32 residue, u16 start_pg) u32 *buf, u32 residue, u16 start_pg)
{ {

1
drivers/net/wireless/realtek/rtw88/fw.h
View File

@ -809,6 +809,7 @@ void rtw_add_rsvd_page_pno(struct rtw_dev *rtwdev,
void rtw_add_rsvd_page_sta(struct rtw_dev *rtwdev, void rtw_add_rsvd_page_sta(struct rtw_dev *rtwdev,
struct rtw_vif *rtwvif); struct rtw_vif *rtwvif);
int rtw_fw_download_rsvd_page(struct rtw_dev *rtwdev); int rtw_fw_download_rsvd_page(struct rtw_dev *rtwdev);
void rtw_fw_update_beacon_work(struct work_struct *work);
void rtw_send_rsvd_page_h2c(struct rtw_dev *rtwdev); void rtw_send_rsvd_page_h2c(struct rtw_dev *rtwdev);
int rtw_dump_drv_rsvd_page(struct rtw_dev *rtwdev, int rtw_dump_drv_rsvd_page(struct rtw_dev *rtwdev,
u32 offset, u32 size, u32 *buf); u32 offset, u32 size, u32 *buf);

4
drivers/net/wireless/realtek/rtw88/mac80211.c
View File

@ -493,9 +493,7 @@ static int rtw_ops_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
{ {
struct rtw_dev *rtwdev = hw->priv; struct rtw_dev *rtwdev = hw->priv;
mutex_lock(&rtwdev->mutex); ieee80211_queue_work(hw, &rtwdev->update_beacon_work);
rtw_fw_download_rsvd_page(rtwdev);
mutex_unlock(&rtwdev->mutex);
return 0; return 0;
} }

2
drivers/net/wireless/realtek/rtw88/main.c
View File

@ -1442,6 +1442,7 @@ void rtw_core_stop(struct rtw_dev *rtwdev)
mutex_unlock(&rtwdev->mutex); mutex_unlock(&rtwdev->mutex);
cancel_work_sync(&rtwdev->c2h_work); cancel_work_sync(&rtwdev->c2h_work);
cancel_work_sync(&rtwdev->update_beacon_work);
cancel_delayed_work_sync(&rtwdev->watch_dog_work); cancel_delayed_work_sync(&rtwdev->watch_dog_work);
cancel_delayed_work_sync(&coex->bt_relink_work); cancel_delayed_work_sync(&coex->bt_relink_work);
cancel_delayed_work_sync(&coex->bt_reenable_work); cancel_delayed_work_sync(&coex->bt_reenable_work);
@ -1998,6 +1999,7 @@ int rtw_core_init(struct rtw_dev *rtwdev)
INIT_WORK(&rtwdev->c2h_work, rtw_c2h_work); INIT_WORK(&rtwdev->c2h_work, rtw_c2h_work);
INIT_WORK(&rtwdev->ips_work, rtw_ips_work); INIT_WORK(&rtwdev->ips_work, rtw_ips_work);
INIT_WORK(&rtwdev->fw_recovery_work, rtw_fw_recovery_work); INIT_WORK(&rtwdev->fw_recovery_work, rtw_fw_recovery_work);
INIT_WORK(&rtwdev->update_beacon_work, rtw_fw_update_beacon_work);
INIT_WORK(&rtwdev->ba_work, rtw_txq_ba_work); INIT_WORK(&rtwdev->ba_work, rtw_txq_ba_work);
skb_queue_head_init(&rtwdev->c2h_queue); skb_queue_head_init(&rtwdev->c2h_queue);
skb_queue_head_init(&rtwdev->coex.queue); skb_queue_head_init(&rtwdev->coex.queue);

1
drivers/net/wireless/realtek/rtw88/main.h
View File

@ -2008,6 +2008,7 @@ struct rtw_dev {
struct work_struct c2h_work; struct work_struct c2h_work;
struct work_struct ips_work; struct work_struct ips_work;
struct work_struct fw_recovery_work; struct work_struct fw_recovery_work;
struct work_struct update_beacon_work;
/* used to protect txqs list */ /* used to protect txqs list */
spinlock_t txq_lock; spinlock_t txq_lock;

7
net/mac80211/chan.c
View File

@ -1749,12 +1749,9 @@ int ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata)
if (new_ctx->replace_state == IEEE80211_CHANCTX_REPLACE_NONE) { if (new_ctx->replace_state == IEEE80211_CHANCTX_REPLACE_NONE) {
if (old_ctx) if (old_ctx)
err = ieee80211_vif_use_reserved_reassign(sdata); return ieee80211_vif_use_reserved_reassign(sdata);
else
err = ieee80211_vif_use_reserved_assign(sdata);
if (err) return ieee80211_vif_use_reserved_assign(sdata);
return err;
} }
/* /*