Commit 74346c43 authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'wireless-drivers-for-davem-2019-09-05' of... 

Merge tag 'wireless-drivers-for-davem-2019-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers



Kalle Valo says:

====================
wireless-drivers fixes for 5.3

Fourth set of fixes for 5.3, and hopefully really the last one. Quite
a few CVE fixes this time but at least to my knowledge none of them
have a known exploit.

mt76

* workaround firmware hang by disabling hardware encryption on MT7630E

* disable 5GHz band for MT7630E as it's not working properly

mwifiex

* fix IE parsing to avoid a heap buffer overflow

iwlwifi

* fix for QuZ device initialisation

rt2x00

* another fix for rekeying

* revert a commit causing degradation in rx signal levels

rsi

* fix a double free
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents b0a3caea 8b51dc72

drivers/net/wireless/intel/iwlwifi/pcie/drv.c

+12 −12
Original line number Diff line number Diff line
@@ -1070,18 +1070,18 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 


	/* same thing for QuZ... */

	if (iwl_trans->hw_rev == CSR_HW_REV_TYPE_QUZ) {

		if (cfg == &iwl_ax101_cfg_qu_hr)

			cfg = &iwl_ax101_cfg_quz_hr;

		else if (cfg == &iwl_ax201_cfg_qu_hr)

			cfg = &iwl_ax201_cfg_quz_hr;

		else if (cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0)

			cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc;

		else if (cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0)

			cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc;

		else if (cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0)

			cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc;

		else if (cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0)

			cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc;

		if (iwl_trans->cfg == &iwl_ax101_cfg_qu_hr)

			iwl_trans->cfg = &iwl_ax101_cfg_quz_hr;

		else if (iwl_trans->cfg == &iwl_ax201_cfg_qu_hr)

			iwl_trans->cfg = &iwl_ax201_cfg_quz_hr;

		else if (iwl_trans->cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0)

			iwl_trans->cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc;

		else if (iwl_trans->cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0)

			iwl_trans->cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc;

		else if (iwl_trans->cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0)

			iwl_trans->cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc;

		else if (iwl_trans->cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0)

			iwl_trans->cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc;

	}



#endif

drivers/net/wireless/marvell/mwifiex/ie.c

+3 −0
Original line number Diff line number Diff line
@@ -241,6 +241,9 @@ static int mwifiex_update_vs_ie(const u8 *ies, int ies_len, 
		}



		vs_ie = (struct ieee_types_header *)vendor_ie;

		if (le16_to_cpu(ie->ie_length) + vs_ie->len + 2 >

			IEEE_MAX_IE_SIZE)

			return -EINVAL;

		memcpy(ie->ie_buffer + le16_to_cpu(ie->ie_length),

		       vs_ie, vs_ie->len + 2);

		le16_unaligned_add_cpu(&ie->ie_length, vs_ie->len + 2);

drivers/net/wireless/marvell/mwifiex/uap_cmd.c

+8 −1
Original line number Diff line number Diff line
@@ -265,6 +265,8 @@ mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg, 


	rate_ie = (void *)cfg80211_find_ie(WLAN_EID_SUPP_RATES, var_pos, len);

	if (rate_ie) {

		if (rate_ie->len > MWIFIEX_SUPPORTED_RATES)

			return;

		memcpy(bss_cfg->rates, rate_ie + 1, rate_ie->len);

		rate_len = rate_ie->len;

	}
@@ -272,8 +274,11 @@ mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg, 
	rate_ie = (void *)cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES,

					   params->beacon.tail,

					   params->beacon.tail_len);

	if (rate_ie)

	if (rate_ie) {

		if (rate_ie->len > MWIFIEX_SUPPORTED_RATES - rate_len)

			return;

		memcpy(bss_cfg->rates + rate_len, rate_ie + 1, rate_ie->len);

	}



	return;

}
@@ -391,6 +396,8 @@ mwifiex_set_wmm_params(struct mwifiex_private *priv, 
					    params->beacon.tail_len);

	if (vendor_ie) {

		wmm_ie = vendor_ie;

		if (*(wmm_ie + 1) > sizeof(struct mwifiex_types_wmm_info))

			return;

		memcpy(&bss_cfg->wmm_info, wmm_ie +

		       sizeof(struct ieee_types_header), *(wmm_ie + 1));

		priv->wmm_enabled = 1;

drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c

+5 −0
Original line number Diff line number Diff line
@@ -59,6 +59,11 @@ static void mt76x0_set_chip_cap(struct mt76x02_dev *dev) 
		dev_dbg(dev->mt76.dev, "mask out 2GHz support\n");

	}



	if (is_mt7630(dev)) {

		dev->mt76.cap.has_5ghz = false;

		dev_dbg(dev->mt76.dev, "mask out 5GHz support\n");

	}



	if (!mt76x02_field_valid(nic_conf1 & 0xff))

		nic_conf1 &= 0xff00;

drivers/net/wireless/mediatek/mt76/mt76x0/pci.c

+14 −1
Original line number Diff line number Diff line
@@ -62,6 +62,19 @@ static void mt76x0e_stop(struct ieee80211_hw *hw) 
	mt76x0e_stop_hw(dev);

}



static int

mt76x0e_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,

		struct ieee80211_vif *vif, struct ieee80211_sta *sta,

		struct ieee80211_key_conf *key)

{

	struct mt76x02_dev *dev = hw->priv;



	if (is_mt7630(dev))

		return -EOPNOTSUPP;



	return mt76x02_set_key(hw, cmd, vif, sta, key);

}



static void

mt76x0e_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,

	      u32 queues, bool drop)
@@ -78,7 +91,7 @@ static const struct ieee80211_ops mt76x0e_ops = { 
	.configure_filter = mt76x02_configure_filter,

	.bss_info_changed = mt76x02_bss_info_changed,

	.sta_state = mt76_sta_state,

	.set_key = mt76x02_set_key,

	.set_key = mt76x0e_set_key,

	.conf_tx = mt76x02_conf_tx,

	.sw_scan_start = mt76x02_sw_scan,

	.sw_scan_complete = mt76x02_sw_scan_complete,

CRA Git | Maintained and supported by SUSTech CRA and CCSE