summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/marvell
AgeCommit message (Collapse)AuthorFilesLines
2024-02-12wifi: mwifiex: Refactor 1-element array into flexible array in struct ↵Kees Cook3-16/+12
mwifiex_ie_types_chan_list_param_set struct mwifiex_ie_types_chan_list_param_set::chan_scan_param is treated as a flexible array, so convert it into one so that it doesn't trip the array bounds sanitizer[1]. Only a few places were using sizeof() on the whole struct, so adjust those to follow the calculation pattern to avoid including the trailing single element. Examining binary output differences doesn't appear to show any literal size values changing, though it is obfuscated a bit by the compiler adjusting register usage and stack spill slots, etc. Link: https://github.com/KSPP/linux/issues/51 [1] Cc: Brian Norris <briannorris@chromium.org> Cc: Kalle Valo <kvalo@kernel.org> Cc: Dmitry Antipov <dmantipov@yandex.ru> Cc: Johannes Berg <johannes.berg@intel.com> Cc: zuoqilin <zuoqilin@yulong.com> Cc: Ruan Jinjie <ruanjinjie@huawei.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Gustavo A. R. Silva <gustavoars@kernel.org> Cc: linux-wireless@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20240207103024.make.423-kees@kernel.org
2024-02-12wifi: mwifiex: use kstrtoX_from_user() in debugfs handlersDmitry Antipov1-15/+4
Use convenient 'kstrtou32_from_user()' in 'mwifiex_verext_write()' and 'kstrtobool_from_user()' in 'mwifiex_timeshare_coex_write()', respectively. Compile tested only. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20240110115314.421298-1-dmantipov@yandex.ru
2024-02-08wifi: cfg80211/mac80211: move puncturing into chandefJohannes Berg1-1/+1
Aloka originally suggested that puncturing should be part of the chandef, so that it's treated correctly. At the time, I disagreed and it ended up not part of the chandef, but I've now realized that this was wrong. Even for clients, the RX, and perhaps more importantly, CCA configuration needs to take puncturing into account. Move puncturing into the chandef, and adjust all the code accordingly. Also add a few tests for puncturing in chandef compatibility checking. Link: https://lore.kernel.org/linux-wireless/20220214223051.3610-1-quic_alokad@quicinc.com/ Suggested-by: Aloka Dixit <quic_alokad@quicinc.com> Link: https://msgid.link/20240129194108.307183a5d2e5.I4d7fe2f126b2366c1312010e2900dfb2abffa0f6@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-02-08wifi: mac80211: simplify non-chanctx driversJohannes Berg2-0/+8
There are still surprisingly many non-chanctx drivers, but in mac80211 that code is a bit awkward. Simplify this by having those drivers assign 'emulated' ops, so that the mac80211 code can be more unified between non-chanctx/chanctx drivers. This cuts the number of places caring about it by about 15, which are scattered across - now they're fewer and no longer in the channel context handling. Link: https://msgid.link/20240129194108.6d0ead50f5cf.I60d093b2fc81ca1853925a4d0ac3a2337d5baa5b@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-02-05wifi: mwifiex: Drop unused headersLinus Walleij1-2/+0
The mwifiex driver include two legacy GPIO headers but does not use symbols from any of them. The driver does contain some "gpio" handling code, but this is some custom GPIO interface, not the Linux GPIO. Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20240131-descriptors-wireless-v1-4-e1c7c5d68746@linaro.org
2024-02-05wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()Zhipeng Lu1-2/+11
In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer(). Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver") Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20240126075336.2825608-1-alexious@zju.edu.cn
2024-01-26Merge tag 'wireless-next-2024-01-25' of ↵Jakub Kicinski3-5/+2
git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Kalle Valo says: ==================== wireless-next patches for v6.9 The first "new features" pull request for v6.9. We have only driver changes this time and most of them are for Realtek drivers. Really nice to see activity in Broadcom drivers again. Major changes: rtwl8xxxu * RTL8188F: concurrent interface support * Channel Switch Announcement (CSA) support in AP mode brcmfmac * per-vendor feature support * per-vendor SAE password setup rtlwifi * speed up USB firmware initialisation * tag 'wireless-next-2024-01-25' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (105 commits) wifi: iwlegacy: Use kcalloc() instead of kzalloc() wifi: rtw89: fix disabling concurrent mode TX hang issue wifi: rtw89: fix HW scan timeout due to TSF sync issue wifi: rtw89: add wait/completion for abort scan wifi: rtw89: fix null pointer access when abort scan wifi: rtw89: disable RTS when broadcast/multicast wifi: rtw89: Set default CQM config if not present wifi: rtw89: refine hardware scan C2H events wifi: rtw89: refine add_chan H2C command to encode_bits wifi: rtw89: 8922a: add BTG functions to assist BT coexistence to control TX/RX wifi: rtw89: 8922a: add TX power related ops wifi: rtw89: 8922a: add register definitions of H2C, C2H, page, RRSR and EDCCA wifi: rtw89: 8922a: add chip_ops related to BB init wifi: rtw89: 8922a: add chip_ops::{enable,disable}_bb_rf wifi: rtw89: add mlo_dbcc_mode for WiFi 7 chips wifi: rtlwifi: Speed up firmware loading for USB wifi: rtl8xxxu: add missing number of sec cam entries for all variants wifi: brcmfmac: allow per-vendor event handling wifi: brcmfmac: avoid invalid list operation when vendor attach fails wifi: brcmfmac: Demote vendor-specific attach/detach messages to info ... ==================== Link: https://lore.kernel.org/r/20240125104030.B6CA6C433C7@smtp.kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-01-18Merge tag 'usb-6.8-rc1' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 6.8-rc1. Included in here are the following: - Thunderbolt subsystem and driver updates for USB 4 hardware and issues reported by real devices - xhci driver updates - dwc3 driver updates - uvc_video gadget driver updates - typec driver updates - gadget string functions cleaned up - other small changes All of these have been in the linux-next tree for a while with no reported issues" * tag 'usb-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (169 commits) usb: typec: tipd: fix use of device-specific init function usb: typec: tipd: Separate reset for TPS6598x usb: mon: Fix atomicity violation in mon_bin_vma_fault usb: gadget: uvc: Remove nested locking usb: gadget: uvc: Fix use are free during STREAMOFF usb: typec: class: fix typec_altmode_put_partner to put plugs dt-bindings: usb: dwc3: Limit num-hc-interrupters definition dt-bindings: usb: xhci: Add num-hc-interrupters definition xhci: add support to allocate several interrupters USB: core: Use device_driver directly in struct usb_driver and usb_device_driver arm64: dts: mediatek: mt8195: Add 'rx-fifo-depth' for cherry usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer dt-bindings: usb: mtk-xhci: add a property for Gen1 isoc-in transfer issue arm64: dts: qcom: msm8996: Remove PNoC clock from MSS arm64: dts: qcom: msm8996: Remove AGGRE2 clock from SLPI arm64: dts: qcom: msm8998: Remove AGGRE2 clock from SLPI arm64: dts: qcom: msm8939: Drop RPM bus clocks arm64: dts: qcom: sdm630: Drop RPM bus clocks arm64: dts: qcom: qcs404: Drop RPM bus clocks arm64: dts: qcom: msm8996: Drop RPM bus clocks ...
2024-01-18wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()Jinjie Ruan1-3/+0
debugfs_create_dir() returns ERR_PTR and never return NULL. As Russell suggested, this patch removes the error checking for debugfs_create_dir(). This is because the DebugFS kernel API is developed in a way that the caller can safely ignore the errors that occur during the creation of DebugFS nodes. The debugfs APIs have a IS_ERR() judge in start_creating() which can handle it gracefully. So these checks are unnecessary. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20230903030216.1509013-3-ruanjinjie@huawei.com
2024-01-18wifi: mwifiex: Use helpers to check multicast addressesRuan Jinjie2-2/+2
Use is_multicast_ether_addr() and is_unicast_ether_addr() to check the addresses. Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20230814124212.302738-3-ruanjinjie@huawei.com
2024-01-04USB: core: Use device_driver directly in struct usb_driver and usb_device_driverYajun Deng1-1/+1
There is usbdrv_wrap in struct usb_driver and usb_device_driver, it contains device_driver and for_devices. for_devices is used to distinguish between device drivers and interface drivers. Like the is_usb_device(), it tests the type of the device. We can test that if the probe of device_driver is equal to usb_probe_device in is_usb_device_driver(), and then the struct usbdrv_wrap is no longer needed. Clean up struct usbdrv_wrap, use device_driver directly in struct usb_driver and usb_device_driver. This makes the code cleaner. Signed-off-by: Yajun Deng <yajun.deng@linux.dev> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/20240104032822.1896596-1-yajun.deng@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-21wifi: mwifiex: fix uninitialized firmware_statDavid Lin1-1/+1
Variable firmware_stat is possible to be used without initialization. Signed-off-by: David Lin <yu-hao.lin@nxp.com> Fixes: 1c5d463c0770 ("wifi: mwifiex: add extra delay for firmware ready") Cc: stable@vger.kernel.org Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/r/202312192236.ZflaWYCw-lkp@intel.com/ Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20231221015511.1032128-1-yu-hao.lin@nxp.com
2023-12-19wifi: mwifiex: use cfg80211_ssid_eq() instead of mwifiex_ssid_cmp()Dmitry Antipov4-16/+4
Prefer generic 'cfg80211_ssid_eq()' over dropped 'mwifiex_ssid_cmp()'. Compile tested only. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Link: https://msgid.link/20231215123859.196350-2-dmantipov@yandex.ru Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-12-15wifi: mwifiex: configure BSSID consistently when starting APDavid Lin4-0/+12
AP BSSID configuration is missing at AP start. Without this fix, FW returns STA interface MAC address after first init. When hostapd restarts, it gets MAC address from netdev before driver sets STA MAC to netdev again. Now MAC address between hostapd and net interface are different causes STA cannot connect to AP. After that MAC address of uap0 mlan0 become the same. And issue disappears after following hostapd restart (another issue is AP/STA MAC address become the same). This patch fixes the issue cleanly. Signed-off-by: David Lin <yu-hao.lin@nxp.com> Fixes: 12190c5d80bd ("mwifiex: add cfg80211 start_ap and stop_ap handlers") Cc: stable@vger.kernel.org Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Tested-by: Rafael Beims <rafael.beims@toradex.com> # Verdin iMX8MP/SD8997 SD Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20231215005118.17031-1-yu-hao.lin@nxp.com
2023-12-15wifi: mwifiex: add extra delay for firmware readyDavid Lin2-0/+21
For SDIO IW416, due to a bug, FW may return ready before complete full initialization. Command timeout may occur at driver load after reboot. Workaround by adding 100ms delay at checking FW status. Signed-off-by: David Lin <yu-hao.lin@nxp.com> Cc: stable@vger.kernel.org Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Acked-by: Brian Norris <briannorris@chromium.org> Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> # Verdin AM62 (IW416) Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20231208234029.2197-1-yu-hao.lin@nxp.com
2023-11-30wifi: libertas: fix config name in dependency for SDIO supportLukas Bulwahn1-1/+1
Commit 4b478bf6bdd8 ("wifi: libertas: drop 16-bit PCMCIA support") reworks the dependencies for config LIBERTAS, and adds alternative dependencies for USB, SDIO and SPI. The config option SDIO however does not exist in the kernel tree. It was probably intended to refer to the config option MMC, which represents "MMC/SD/SDIO card support" and is used as dependency by various other drivers that use SDIO. Fix the dependency to the config option MMC for declaring the requirement on provision of SDIO support. Fixes: 4b478bf6bdd8 ("wifi: libertas: drop 16-bit PCMCIA support") Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231122083047.12774-1-lukas.bulwahn@gmail.com
2023-11-22wifi: mwifiex: mwifiex_process_sleep_confirm_resp(): remove unused priv variableSu Hui1-8/+0
Clang static analyzer complains that value stored to 'priv' is never read. 'priv' is useless, so remove it to save space. Signed-off-by: Su Hui <suhui@nfschina.com> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231115092328.1048103-1-suhui@nfschina.com
2023-11-14wifi: libertas: stop selecting wextArnd Bergmann1-2/+0
Libertas no longer references the iw_handler infrastructure or wext_spy, so neither of the 'select' statements are used any more. Fixes: e86dc1ca4676 ("Libertas: cfg80211 support") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231108153409.1065286-1-arnd@kernel.org
2023-10-30wifi: libertas: drop 16-bit PCMCIA supportArnd Bergmann3-964/+1
With all the other PCMCIA WLAN adapters gone from the kernel, this is now the last remaining device with this interface, but as far as I can tell, all the actual libertas users were actually using either SDIO or USB. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@kernel.org>
2023-10-06Merge wireless into wireless-nextJohannes Berg3-11/+29
Resolve several conflicts, mostly between changes/fixes in wireless and the locking rework in wireless-next. One of the conflicts actually shows a bug in wireless that we'll want to fix separately. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Kalle Valo <kvalo@kernel.org>
2023-09-25wifi: cfg80211: split struct cfg80211_ap_settingsJohannes Berg1-1/+1
Using the full struct cfg80211_ap_settings for an update is misleading, since most settings cannot be updated. Split the update case off into a new struct cfg80211_ap_update. Change-Id: I3ba4dd9280938ab41252f145227a7005edf327e4 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-22wifi: mwifiex: followup PCIE and related cleanupsDmitry Antipov2-24/+8
Introduce a few more (PCIE and generic interface related) cleanups which becomes reasonable after the previous patch. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230919132804.73340-2-dmantipov@yandex.ru
2023-09-22wifi: mwifiex: simplify PCIE write operationsDmitry Antipov1-224/+66
Since 'mwifiex_write_reg()' just issues void 'iowrite32()', convert the former to 'void' and simplify all related users (with the only exception of 'read_poll_timeout()' which explicitly requires a non-void function argument). Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230919132804.73340-1-dmantipov@yandex.ru
2023-09-21wifi: mwifiex: use MODULE_FIRMWARE to add firmware files metadataVíctor Gonzalo1-0/+6
The mwifiex_pcie driver is missing the MODULE_FIRMWARE macro to add the firmware files needed to the module metadata. Signed-off-by: Víctor Gonzalo <victor.gonzalo@anddroptable.net> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230914211938.28395-1-victor.gonzalo@anddroptable.net
2023-09-21wifi: mwifiex: cleanup struct mwifiex_sdio_mpa_rxDmitry Antipov2-14/+0
Drop filled with NULL pointers but otherwise unused 'skb_arr' array of 'struct mwifiex_sdio_mpa_rx', adjust related code. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230821115254.167552-1-dmantipov@yandex.ru
2023-09-18wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packetPin-yen Lin1-7/+9
Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc1042 headers. Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Pin-yen Lin <treapking@chromium.org> Acked-by: Brian Norris <briannorris@chromium.org> Reviewed-by: Matthew Wang <matthewmwang@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org
2023-09-13wifi: cfg80211: modify prototype for change_beaconAloka Dixit1-1/+2
Modify the prototype for change_beacon() in struct cfg80211_op to accept cfg80211_ap_settings instead of cfg80211_beacon_data so that it can process data in addition to beacons. Modify the prototypes of ieee80211_change_beacon() and driver specific functions accordingly. Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com> Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com> Link: https://lore.kernel.org/r/20230727174100.11721-4-quic_alokad@quicinc.com [while at it, remove pointless "if (info)" check in tracing that just makes all the lines longer than they need be - it's never NULL] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-11wifi: cfg80211: remove wdev mutexJohannes Berg1-2/+2
Since we're now protecting everything with the wiphy mutex (and were really using it for almost everything before), there's no longer any real reason to have a separate wdev mutex. It may feel better, but really has no value. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-04wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_lenGustavo A. R. Silva1-0/+16
Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before decoding data from `event_buf`. This prevents any malicious or buggy firmware from overflowing `event_buf` through large values for `tlv_len` and `tlv_bitmap_len`. Suggested-by: Dan Williams <dcbw@redhat.com> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/d4f8780527d551552ee96f17a0229e02e1c200d1.1692931954.git.gustavoars@kernel.org
2023-09-04wifi: mwifiex: Replace one-element array with flexible-array member in ↵Gustavo A. R. Silva2-2/+2
struct mwifiex_ie_types_rxba_sync One-element and zero-length arrays are deprecated. So, replace one-element array in struct mwifiex_ie_types_rxba_sync with flexible-array member, and refactor the rest of the code, accordingly. This results in no differences in binary output. Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/79c801c69c8beece2f80502c60166036d3c047cc.1692931954.git.gustavoars@kernel.org
2023-09-04wifi: mwifiex: Fix tlv_buf_left calculationGustavo A. R. Silva1-2/+2
In a TLV encoding scheme, the Length part represents the length after the header containing the values for type and length. In this case, `tlv_len` should be: tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len Notice that the `- 1` accounts for the one-element array `bitmap`, which 1-byte size is already included in `sizeof(*tlv_rxba)`. So, if the above is correct, there is a double-counting of some members in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp` are calculated: 968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len); 969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba); in specific, members: drivers/net/wireless/marvell/mwifiex/fw.h:777 777 u8 mac[ETH_ALEN]; 778 u8 tid; 779 u8 reserved; 780 __le16 seq_num; 781 __le16 bitmap_len; This is clearly wrong, and affects the subsequent decoding of data in `event_buf` through `tlv_rxba`: 970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp; Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)` in the calculation of `tlv_buf_left` and `tmp`. This results in the following binary differences before/after changes: | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o | @@ -4698,11 +4698,11 @@ | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968 | tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len); | - 1da7: lea -0x11(%rbx),%edx | + 1da7: lea -0x4(%rbx),%edx | 1daa: movzwl %bp,%eax | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969 | tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len; | - 1dad: lea 0x11(%r15,%rbp,1),%r15 | + 1dad: lea 0x4(%r15,%rbp,1),%r15 The above reflects the desired change: avoid counting 13 too many bytes; which is the total size of the double-counted members in `struct mwifiex_ie_types_rxba_sync`: $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o struct mwifiex_ie_types_rxba_sync { struct mwifiex_ie_types_header header; /* 0 4 */ |----------------------------------------------------------------------- | u8 mac[6]; /* 4 6 */ | | u8 tid; /* 10 1 */ | | u8 reserved; /* 11 1 */ | | __le16 seq_num; /* 12 2 */ | | __le16 bitmap_len; /* 14 2 */ | | u8 bitmap[1]; /* 16 1 */ | |----------------------------------------------------------------------| | 13 bytes| ----------- /* size: 17, cachelines: 1, members: 7 */ /* last cacheline: 17 bytes */ } __attribute__((__packed__)); Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/06668edd68e7a26bbfeebd1201ae077a2a7a8bce.1692931954.git.gustavoars@kernel.org
2023-08-23wifi: mwifiex: avoid possible NULL skb pointer dereferenceDmitry Antipov1-1/+9
In 'mwifiex_handle_uap_rx_forward()', always check the value returned by 'skb_copy()' to avoid potential NULL pointer dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop original skb in case of copying failure. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling") Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru
2023-08-21wifi: mwifiex: fix comment typos in SDIO moduleDmitry Antipov1-2/+2
Fix comment typos around ' mwifiex_deaggr_sdio_pkt()' and 'mwifiex_host_to_card_mp_aggr()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230814142101.60308-2-dmantipov@yandex.ru
2023-08-21wifi: mwifiex: cleanup adapter dataDmitry Antipov3-8/+0
Remove unused and set but unused 'dfs_workqueue', 'dfs_work', and 'scan_channels' members of 'struct mwifiex_adapter', adjust users. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230814142101.60308-1-dmantipov@yandex.ru
2023-08-21wifi: mwifiex: Fix missed return in oob checks failed pathPolaris Pi2-0/+2
Add missed return in mwifiex_uap_queue_bridged_pkt() and mwifiex_process_rx_packet(). Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com> Reported-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com
2023-08-21wifi: mwifiex: use is_zero_ether_addr() instead of ether_addr_equal()Ruan Jinjie1-2/+1
Use is_zero_ether_addr() instead of ether_addr_equal() to check if the ethernet address is all zeros. Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230808081023.2303423-1-ruanjinjie@huawei.com
2023-08-21wifi: mwifiex: drop BUG_ON from TX pathsDmitry Antipov4-44/+34
In 'mwifiex_process_sta_txpd()' and 'mwifiex_process_uap_txpd()', replace 'BUG_ON()' with runtime check, and move all these checks to 'mwifiex_process_tx()'. This way, both callees may be converted to 'void', and the caller may be simplified as well. Suggested-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230802160726.85545-5-dmantipov@yandex.ru
2023-08-21wifi: mwifiex: handle possible mwifiex_write_reg() errorsDmitry Antipov1-10/+12
Return -1 on possible 'mwifiex_write_reg()' errors in 'mwifiex_init_sdio_ioport()', do not ignore the value returned by the latter in 'mwifiex_init_sdio()' and 'mwifiex_sdio_up_dev()' as well. Found by Linux Verification Center (linuxtesting.org) with SVACE. Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230802160726.85545-4-dmantipov@yandex.ru
2023-08-21wifi: mwifiex: handle possible sscanf() errorsDmitry Antipov1-2/+8
Return -EINVAL on possible 'sscanf()' errors in 'mwifiex_regrdwr_write()' and 'mwifiex_rdeeprom_write()'. Found by Linux Verification Center (linuxtesting.org) with SVACE. Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230802160726.85545-3-dmantipov@yandex.ru
2023-08-21wifi: mwifiex: cleanup private data structuresDmitry Antipov5-15/+0
Drop unused fields 'status_code' of 'struct mwifiex_txinfo', 'dfs_chan_switch_timer', 'sleep_params' (including related data type 'struct mwifiex_sleep_params') of 'struct mwifiex_adapter', adjust related code. Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230802160726.85545-2-dmantipov@yandex.ru
2023-08-21wifi: mwifiex: fix memory leak in mwifiex_histogram_read()Dmitry Antipov1-2/+7
Always free the zeroed page on return from 'mwifiex_histogram_read()'. Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support") Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230802160726.85545-1-dmantipov@yandex.ru
2023-08-02wifi: mwifiex: fix error recovery in PCIE buffer descriptor managementDmitry Antipov1-8/+17
Add missing 'kfree_skb()' in 'mwifiex_init_rxq_ring()' and never do 'kfree(card->rxbd_ring_vbase)' because this area is DMAed and should be released with 'dma_free_coherent()'. The latter is performed in 'mwifiex_pcie_delete_rxbd_ring()', which is now called to recover from possible errors in 'mwifiex_pcie_create_rxbd_ring()'. Likewise for 'mwifiex_pcie_init_evt_ring()', 'kfree(card->evtbd_ring_vbase)' 'mwifiex_pcie_delete_evtbd_ring()' and 'mwifiex_pcie_create_rxbd_ring()'. Fixes: d930faee141b ("mwifiex: add support for Marvell pcie8766 chipset") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230731074334.56463-1-dmantipov@yandex.ru
2023-08-01wifi: libertas: prefer kstrtoX() for simple integer conversionsDmitry Antipov1-18/+33
Prefer 'kstrtoX()' family of functions over 'sscanf()' to convert strings to integers and always check results of the conversions. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230725060531.72968-6-dmantipov@yandex.ru
2023-08-01wifi: libertas: handle possible spu_write_u16() errorsDmitry Antipov1-3/+8
Check and handle (well, report at least, as it's done through the rest of the module) possible 'spu_write_u16()' errors in 'if_spi_e2h()'. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230725060531.72968-5-dmantipov@yandex.ru
2023-08-01wifi: libertas: cleanup SDIO resetDmitry Antipov1-12/+22
Embed SDIO reset worker in 'struct if_sdio_card' and so drop 'reset_host' and 'card_reset_work' static variables, adjust related code. Not sure whether it's possible to do something useful on 'mmc_add_host()' error, so just add 'dev_err()' to emit an error message. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230725060531.72968-4-dmantipov@yandex.ru
2023-08-01wifi: libertas: simplify list operations in free_if_spi_card()Dmitry Antipov1-6/+3
Use 'list_for_each_entry_safe()' to simplify list operations in 'free_if_spi_card()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230725060531.72968-3-dmantipov@yandex.ru
2023-08-01wifi: libertas: use convenient lists to manage SDIO packetsDmitry Antipov1-24/+13
Use convenient lists to manage SDIO packets, adjust 'struct if_sdio_packet', 'struct if_sdio_card' and related code accordingly. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230725060531.72968-2-dmantipov@yandex.ru
2023-08-01wifi: libertas: add missing calls to cancel_work_sync()Dmitry Antipov1-0/+2
Add missing 'cancel_work_sync()' in 'if_sdio_remove()' and on error handling path in 'if_sdio_probe()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Tested-by: Dan Williams <dcbw@redhat.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230725060531.72968-1-dmantipov@yandex.ru
2023-08-01wifi: mwifiex: Fix OOB and integer underflow when rx packetsPolaris Pi3-4/+36
Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet not out-of-bounds access the skb->data buffer. Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80211") Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com> Reviewed-by: Matthew Wang <matthewmwang@chromium.org> Reviewed-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com
2023-07-25wifi: mwifiex: Set WIPHY_FLAG_NETNS_OK flagJohannes Wiesboeck1-0/+1
Allow moving the wiphy device for mwififex to a non-inital network namespace. Many wireless drivers enable this flag implicitly by initializing through the generic ieee80211_alloc_hw_nm function. As mwifiex does not utilize this function WIPHY_FLAG_NETNS_OK must be set explicitly. Moving to network namespace and working connection tested using wpa_supplicant from a network namespace as well as from a container on GyroidOS. The hardware was the Toradex Apalis i.MX8QM Board using the Azurewave AW-CM276NF wireless module. Signed-off-by: Johannes Wiesboeck <johannes.wiesboeck@aisec.fraunhofer.de> Reviewed-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230706093437.3380526-1-johannes.wiesboeck@aisec.fraunhofer.de
generated by cgit v1.2.3 (git 2.39.0) at 2024-08-08 19:29:51 +0300