Commit c76b305c authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'wireless-drivers-2020-02-08' of... 

Merge tag 'wireless-drivers-2020-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers



Kalle Valo says:

====================
wireless-drivers fixes for v5.6

First set of fixes for v5.6. Buffer overflow fixes to mwifiex, quite a
few functionality fixes to iwlwifi and smaller fixes to other drivers.

mwifiex

* fix an unlock from a previous security fix

* fix two buffer overflows

libertas

* fix two bugs from previous security fixes

iwlwifi

* fix module removal with multiple NICs

* don't treat IGTK removal failure as an error

* avoid FW crashes due to DTS measurement races

* fix a potential use after free in FTM code

* prevent a NULL pointer dereference in iwl_mvm_cfg_he_sta()

* fix TDLS discovery

* check all CPUs when trying to detect an error during resume

rtw88

* fix clang warning

mt76

* fix reading of max_nss value from a register
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 2696e114 d08f3010

drivers/net/wireless/intel/iwlwifi/mvm/d3.c

+40 −12
Original line number Diff line number Diff line
@@ -1897,27 +1897,55 @@ static void iwl_mvm_d3_disconnect_iter(void *data, u8 *mac, 
		ieee80211_resume_disconnect(vif);

}



static int iwl_mvm_check_rt_status(struct iwl_mvm *mvm,

				   struct ieee80211_vif *vif)

static bool iwl_mvm_rt_status(struct iwl_trans *trans, u32 base, u32 *err_id)

{

	u32 base = mvm->trans->dbg.lmac_error_event_table[0];

	struct error_table_start {

		/* cf. struct iwl_error_event_table */

		u32 valid;

		u32 error_id;

		__le32 err_id;

	} err_info;



	iwl_trans_read_mem_bytes(mvm->trans, base,

	if (!base)

		return false;



	iwl_trans_read_mem_bytes(trans, base,

				 &err_info, sizeof(err_info));

	if (err_info.valid && err_id)

		*err_id = le32_to_cpu(err_info.err_id);



	return !!err_info.valid;

}



	if (err_info.valid &&

	    err_info.error_id == RF_KILL_INDICATOR_FOR_WOWLAN) {

static bool iwl_mvm_check_rt_status(struct iwl_mvm *mvm,

				   struct ieee80211_vif *vif)

{

	u32 err_id;



	/* check for lmac1 error */

	if (iwl_mvm_rt_status(mvm->trans,

			      mvm->trans->dbg.lmac_error_event_table[0],

			      &err_id)) {

		if (err_id == RF_KILL_INDICATOR_FOR_WOWLAN) {

			struct cfg80211_wowlan_wakeup wakeup = {

				.rfkill_release = true,

			};

		ieee80211_report_wowlan_wakeup(vif, &wakeup, GFP_KERNEL);

			ieee80211_report_wowlan_wakeup(vif, &wakeup,

						       GFP_KERNEL);

		}

	return err_info.valid;

		return true;

	}



	/* check if we have lmac2 set and check for error */

	if (iwl_mvm_rt_status(mvm->trans,

			      mvm->trans->dbg.lmac_error_event_table[1], NULL))

		return true;



	/* check for umac error */

	if (iwl_mvm_rt_status(mvm->trans,

			      mvm->trans->dbg.umac_error_event_table, NULL))

		return true;



	return false;

}



static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)

drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c

+4 −1
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH

 * Copyright (C) 2018 Intel Corporation

 * Copyright (C) 2019 Intel Corporation

 * Copyright (C) 2020 Intel Corporation

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@ 
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH

 * Copyright (C) 2018 Intel Corporation

 * Copyright (C) 2019 Intel Corporation

 * Copyright (C) 2020 Intel Corporation

 * All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without
@@ -528,6 +530,8 @@ void iwl_mvm_ftm_abort(struct iwl_mvm *mvm, struct cfg80211_pmsr_request *req) 
	if (req != mvm->ftm_initiator.req)

		return;



	iwl_mvm_ftm_reset(mvm);



	if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(TOF_RANGE_ABORT_CMD,

						 LOCATION_GROUP, 0),

				 0, sizeof(cmd), &cmd))
@@ -641,7 +645,6 @@ void iwl_mvm_ftm_range_resp(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb) 
	lockdep_assert_held(&mvm->mutex);



	if (!mvm->ftm_initiator.req) {

		IWL_ERR(mvm, "Got FTM response but have no request?\n");

		return;

	}

drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c

+4 −6
Original line number Diff line number Diff line
@@ -5,10 +5,9 @@ 
 *

 * GPL LICENSE SUMMARY

 *

 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.

 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH

 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH

 * Copyright(c) 2018 - 2019 Intel Corporation

 * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of version 2 of the GNU General Public License as
@@ -28,10 +27,9 @@ 
 *

 * BSD LICENSE

 *

 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.

 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH

 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH

 * Copyright(c) 2018 - 2019 Intel Corporation

 * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation

 * All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without
@@ -2037,7 +2035,7 @@ static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm, 
	rcu_read_lock();



	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);

	if (IS_ERR(sta)) {

	if (IS_ERR_OR_NULL(sta)) {

		rcu_read_unlock();

		WARN(1, "Can't find STA to configure HE\n");

		return;
@@ -3293,7 +3291,7 @@ static void iwl_mvm_mac_mgd_prepare_tx(struct ieee80211_hw *hw, 
	if (fw_has_capa(&mvm->fw->ucode_capa,

			IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))

		iwl_mvm_schedule_session_protection(mvm, vif, 900,

						    min_duration);

						    min_duration, false);

	else

		iwl_mvm_protect_session(mvm, vif, duration,

					min_duration, 500, false);

drivers/net/wireless/intel/iwlwifi/mvm/sta.c

+7 −3
Original line number Diff line number Diff line
@@ -3320,6 +3320,10 @@ static int iwl_mvm_send_sta_igtk(struct iwl_mvm *mvm, 
	igtk_cmd.sta_id = cpu_to_le32(sta_id);



	if (remove_key) {

		/* This is a valid situation for IGTK */

		if (sta_id == IWL_MVM_INVALID_STA)

			return 0;



		igtk_cmd.ctrl_flags |= cpu_to_le32(STA_KEY_NOT_VALID);

	} else {

		struct ieee80211_key_seq seq;
@@ -3574,9 +3578,9 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, 
	IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",

		      keyconf->keyidx, sta_id);



	if (mvm_sta && (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||

	if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||

	    keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||

			keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256))

	    keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)

		return iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, true);



	if (!__test_and_clear_bit(keyconf->hw_key_idx, mvm->fw_key_table)) {

drivers/net/wireless/intel/iwlwifi/mvm/tdls.c

+8 −2
Original line number Diff line number Diff line
@@ -205,9 +205,15 @@ void iwl_mvm_mac_mgd_protect_tdls_discover(struct ieee80211_hw *hw, 
	struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);

	u32 duration = 2 * vif->bss_conf.dtim_period * vif->bss_conf.beacon_int;



	mutex_lock(&mvm->mutex);

	/* Protect the session to hear the TDLS setup response on the channel */

	iwl_mvm_protect_session(mvm, vif, duration, duration, 100, true);

	mutex_lock(&mvm->mutex);

	if (fw_has_capa(&mvm->fw->ucode_capa,

			IWL_UCODE_TLV_CAPA_SESSION_PROT_CMD))

		iwl_mvm_schedule_session_protection(mvm, vif, duration,

						    duration, true);

	else

		iwl_mvm_protect_session(mvm, vif, duration,

					duration, 100, true);

	mutex_unlock(&mvm->mutex);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE