aboutsummaryrefslogtreecommitdiff
path: root/drivers/net/wireless/ath
AgeCommit message (Collapse)AuthorFilesLines
2019-09-17ath10k: add cleanup in ath10k_sta_state()Wenwen Wang1-1/+5
If 'sta->tdls' is false, no cleanup is executed, leading to memory/resource leaks, e.g., 'arsta->tx_stats'. To fix this issue, perform cleanup before go to the 'exit' label. Signed-off-by: Wenwen Wang <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: revalidate the msa region coming from firmwareGovind Singh1-0/+15
driver sends QMI_WLFW_MSA_INFO_REQ_V01 QMI request to firmware and in response expects range of addresses and size to be mapped. Add condition to check whether addresses in response falls under valid range otherwise return failure. Testing: Tested on WCN3990 HW Tested FW: WLAN.HL.3.1-01040-QCAHLSWMTPLZ-1 Signed-off-by: Govind Singh <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: use ath10k_pci_soc_ functions for all warm_reset instancesTomislav Požega1-15/+11
Use ath10k_pci_soc_read32 / ath10k_pci_soc_write32 functions for the rest of warm_reset functions. Until now these have been used only for ath10k_pci_warm_reset_si0, but since they already exist it makes sense to simplify code a bit. Runtime tested with QCA9862. Signed-off-by: Tomislav Požega <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: Use ARRAY_SIZEVasyl Gomonovych1-2/+1
fix coccinelle warning, use ARRAY_SIZE Signed-off-by: Vasyl Gomonovych <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: avoid leaving .bss_info_changed prematurelySven Eckelmann1-26/+36
ath10k_bss_info_changed() handles various events from the upper layers. It parses the changed bitfield and then configures the driver/firmware accordingly. Each detected event is handled in a separate scope which is independent of each other - but in the same function. The commit f279294e9ee2 ("ath10k: add support for configuring management packet rate") changed this behavior by returning from this function prematurely when some precondition was not fulfilled. All new event handlers added after the BSS_CHANGED_BASIC_RATES event handler would then also be skipped. Signed-off-by: Sven Eckelmann <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: Use standard bulk clock API in snocBjorn Andersson2-115/+21
No frequency is currently specified for the single clock defined in the snoc driver, so the clock wrappers reimplements the standard bulk API provided by the clock framework. Change to this. The single clock defined is marked as optional so this version of the get API is used, but might need to be reconsidered in the future. Signed-off-by: Bjorn Andersson <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: Use standard regulator bulk API in snocBjorn Andersson2-170/+27
The regulator_get_optional() exists for cases where the driver needs do behave differently depending on some regulator supply being present or not, as we don't use this we can use the standard regulator_get() and rely on its handling of unspecified regulators. While the driver currently doesn't specify any loads the regulator framework was updated last year to only account for load of enabled regulators, so should the need appear it's better to apply load numbers during initialization that dynamically. With this the regulator wrappers have been reduced the become identical to the standard bulk API provided by the regulator framework, so use these instead of rolling our own. Signed-off-by: Bjorn Andersson <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: snoc: skip regulator operationsBjorn Andersson2-23/+6
The regulator operations is trying to set a voltage to a fixed value, by giving some wiggle room. But some board designs specifies regulator voltages outside this limited range. One such example is the Lenovo Yoga C630, with vdd-3.3-ch0 in particular specified at 3.1V. But consumers with fixed voltage requirements should just rely on the board configuration to provide the power at the required level, so this code should be removed. Signed-off-by: Bjorn Andersson <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: Fix HOST capability QMI incompatibilityBjorn Andersson5-3/+45
The introduction of 768ec4c012ac ("ath10k: update HOST capability QMI message") served the purpose of supporting the new and extended HOST capability QMI message. But while the new message adds a slew of optional members it changes the data type of the "daemon_support" member, which means that older versions of the firmware will fail to decode the incoming request message. There is no way to detect this breakage from Linux and there's no way to recover from sending the wrong message (i.e. we can't just try one format and then fallback to the other), so a quirk is introduced in DeviceTree to indicate to the driver that the firmware requires the 8bit version of this message. Cc: [email protected] Fixes: 768ec4c012ac ("ath10k: update HOST capability qmi message") Signed-off-by: Bjorn Andersson <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-17ath10k: Check if station exists before forwarding tx airtime reportHauke Mehrtens1-1/+1
It looks like the FW on QCA9984 already reports the tx airtimes before the station is added to the peer entry. The peer entry is created in ath10k_peer_map_event() just with the vdev_id and the ethaddr, but not with a station entry, this is added later in ath10k_peer_create() in callbacks from mac80211. When there is no sta added to the peer entry, this function fails because it calls ieee80211_sta_register_airtime() with NULL. This was reported in OpenWrt some time ago: https://bugs.openwrt.org/index.php?do=details&task_id=2414 This commit should fix this crash: [ 75.991714] Unable to handle kernel paging request at virtual address fffff9e8 [ 75.991756] pgd = c0204000 [ 75.997955] [fffff9e8] *pgd=5fdfd861, *pte=00000000, *ppte=00000000 [ 76.000537] Internal error: Oops: 37 [#1] SMP ARM [ 76.006686] Modules linked in: pppoe ppp_async ath10k_pci ath10k_core ath pptp pppox ppp_mppe ppp_generic mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_recent xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_helper xt_esp xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY usbserial slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_netlink iptable_raw iptable_mangle iptable_filter ipt_ah ipt_ECN ip_tables crc_ccitt compat chaoskey fuse sch_cake sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 [ 76.059974] cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred ledtrig_usbport xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6t_NPT ip6t_MASQUERADE nf_nat_masquerade_ipv6 nf_nat nf_conntrack nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 msdos ip_gre gre ifb sit tunnel4 ip_tunnel tun vfat fat hfsplus cifs nls_utf8 nls_iso8859_15 nls_iso8859_1 nls_cp850 nls_cp437 nls_cp1250 sha1_generic md5 md4 [ 76.130634] usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_of_simple ohci_platform ohci_hcd phy_qcom_dwc3 ahci ehci_platform sd_mod ahci_platform libahci_platform libahci libata scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 exfat crc32c_generic [ 76.154772] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.132 #0 [ 76.177001] Hardware name: Generic DT based system [ 76.182990] task: c0b06d80 task.stack: c0b00000 [ 76.187832] PC is at ieee80211_sta_register_airtime+0x24/0x148 [mac80211] [ 76.192211] LR is at ath10k_htt_t2h_msg_handler+0x678/0x10f4 [ath10k_core] [ 76.199052] pc : [<bf75bfac>] lr : [<bf83e8b0>] psr: a0000113 [ 76.205820] sp : c0b01d54 ip : 00000002 fp : bf869c0c [ 76.211981] r10: 0000003c r9 : dbdca138 r8 : 00060002 [ 76.217192] r7 : 00000000 r6 : dabe1150 r5 : 00000000 r4 : dbdc95c0 [ 76.222401] r3 : 00000000 r2 : 00060002 r1 : 00000000 r0 : 00000000 [ 76.229003] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 76.235509] Control: 10c5787d Table: 5c94006a DAC: 00000051 [ 76.242716] Process swapper/0 (pid: 0, stack limit = 0xc0b00210) [ 76.248446] Stack: (0xc0b01d54 to 0xc0b02000) [ 76.254532] 1d40: dbdc95c0 00000000 dabe1150 [ 76.258808] 1d60: 00000001 dabe1150 dbdca138 0000003c bf869c0c bf83e8b0 00000002 c0314b10 [ 76.266969] 1d80: dbdc9c70 00000001 00000001 dabe114c 00010000 00000000 dbdcd724 bf88f3d8 [ 76.275126] 1da0: c0310d28 db393c00 dbdc95c0 00000000 c0b01dd0 c07fb4c4 dbdcd724 00000001 [ 76.283286] 1dc0: 00000022 bf88b09c db393c00 00000022 c0b01dd0 c0b01dd0 00000000 dbdcc5c0 [ 76.291445] 1de0: bf88f04c dbdcd654 dbdcd71c dbdc95c0 00000014 dbdcd724 dbdcc5c0 00000005 [ 76.299605] 1e00: 0004b400 bf85c360 00000000 bf87101c c0b01e24 00000006 00000000 dbdc95c0 [ 76.307764] 1e20: 00000001 00000040 0000012c c0b01e80 1cf51000 bf85c448 dbdcd440 dbdc95c0 [ 76.315925] 1e40: dbdca440 ffffa880 00000040 bf88cb68 dbdcd440 00000001 00000040 ffffa880 [ 76.324084] 1e60: c0b02d00 c06d72e0 dd990080 c0a3f080 c0b255dc c0b047e4 c090afac c090e80c [ 76.332244] 1e80: c0b01e80 c0b01e80 c0b01e88 c0b01e88 dd4cc200 00000000 00000003 c0b0208c [ 76.340405] 1ea0: c0b02080 40000003 ffffe000 00000100 c0b02080 c03015c8 00000000 00000001 [ 76.348564] 1ec0: dd408000 c0a38210 c0b2c7c0 0000000a ffffa880 c0b02d00 c07fb764 00200102 [ 76.356723] 1ee0: dd4cc268 c0a3e414 00000000 00000000 00000001 dd408000 de803000 00000000 [ 76.364883] 1f00: 00000000 c03247cc c0a3e414 c0368f1c c0b03f60 c0b153cc de80200c de802000 [ 76.373042] 1f20: c0b01f48 c0301488 c0308630 60000013 ffffffff c0b01f7c 00000000 c0b00000 [ 76.381204] 1f40: 00000000 c030c08c 00000001 00000000 00000000 c0315180 ffffe000 c0b03cc0 [ 76.389363] 1f60: c0b03c70 00000000 00000000 c0a2da28 00000000 00000000 c0b01f90 c0b01f98 [ 76.397522] 1f80: c030862c c0308630 60000013 ffffffff 00000051 00000000 ffffe000 c035dd18 [ 76.405681] 1fa0: 000000bf c0b03c40 00000000 c0b2c000 dddfce80 c035e060 c0b2c040 c0a00cf4 [ 76.413842] 1fc0: ffffffff ffffffff 00000000 c0a0067c c0a2da28 00000000 00000000 c0b2c1d4 [ 76.422001] 1fe0: c0b03c5c c0a2da24 c0b07ee0 4220406a 512f04d0 4220807c 00000000 00000000 [ 76.430335] [<bf75bfac>] (ieee80211_sta_register_airtime [mac80211]) from [<00000002>] (0x2) [ 76.438314] Code: e1cd81f0 e1a08002 e1cda1f8 e58de020 (e5102618) [ 76.446965] ---[ end trace 227a38ade964d642 ]--- Fixes: bb31b7cb106c ("ath10k: report tx airtime provided by fw") Signed-off-by: Hauke Mehrtens <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: ignore reset errors for FW during probeLior David1-3/+1
There are special kinds of FW such as WMI only which are used for testing, diagnostics and other specific scenario. Such FW is loaded during driver probe and the driver disallows enabling any network interface, to avoid operational issues. In many cases it is used to debug early versions of FW with new features, which sometimes fail on startup. Currently when such FW fails to load (for example, because of init failure), the driver probe would fail and shutdown the device making it difficult to debug the early failure. To fix this, ignore load failures in WMI only FW and allow driver probe to succeed, making it possible to continue and debug the FW load failure. Signed-off-by: Lior David <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: fix RX short frame checkLior David1-2/+2
The short frame check in wil_sring_reap_rx_edma uses skb->len which store the maximum frame length. Fix this to use dmalen which is the actual length of the received frame. Signed-off-by: Lior David <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: use writel_relaxed in wil_debugfs_iomem_x32_setLior David1-1/+2
writel_relaxed can be used in wil_debugfs_iomem_x32_set since there is a wmb call immediately after. Signed-off-by: Lior David <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: report boottime_ns in scan resultsMaya Erez1-4/+17
Call cfg80211_inform_bss_frame_data to report cfg80211 on the boottime_ns in order to prevent the scan results filtering due to aging. Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: properly initialize discovery_expired_workDedy Lansky1-0/+1
Upon driver rmmod, cancel_work_sync() can be invoked on p2p.discovery_expired_work before this work struct was initialized. This causes a WARN_ON with newer kernel version. Add initialization of discovery_expired_work inside wil_vif_init(). Signed-off-by: Dedy Lansky <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: verify cid value is validAlexei Avshalom Lazar1-0/+6
cid value is not being verified in wmi_evt_delba(), verification is added. Signed-off-by: Alexei Avshalom Lazar <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: make sure DR bit is read before rest of the status messageDedy Lansky2-18/+18
Due to compiler optimization, it's possible that dr_bit (descriptor ready) is read last from the status message. Due to race condition between HW writing the status message and driver reading it, other fields that were read earlier (before dr_bit) could have invalid values. Fix this by explicitly reading the dr_bit first and then using rmb before reading the rest of the status message. Signed-off-by: Dedy Lansky <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: fix PTK re-key raceAhmad Masri9-3/+276
Fix a race between cfg80211 add_key call and transmitting of 4/4 EAP packet. In case the transmit is delayed until after the add key takes place, message 4/4 will be encrypted with the new key, and the receiver side (AP) will drop it due to MIC error. Wil6210 will monitor and look for the transmitted packet 4/4 eap key. In case add_key takes place before the transmission completed, then wil6210 will let the FW store the key and wil6210 will notify the FW to use the PTK key only after 4/4 eap packet transmission was completed. Signed-off-by: Ahmad Masri <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: add debugfs to show PMC ring contentDedy Lansky3-0/+40
PMC is a hardware debug mechanism which allows capturing real time debug data and stream it to host memory. The driver allocates memory buffers and set them inside PMC ring of descriptors. Add pmcring debugfs that application can use to read the binary content of descriptors inside the PMC ring (cat pmcring). Signed-off-by: Dedy Lansky <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12wil6210: add wil_netif_rx() helper functionDedy Lansky2-24/+38
Move common part of wil_netif_rx_any into new helper function and add support for non-gro receive using netif_rx_ni. Signed-off-by: Dedy Lansky <[email protected]> Signed-off-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12ath10k: fix channel info parsing for non tlv targetRakesh Pillai3-9/+17
The tlv targets such as WCN3990 send more data in the chan info event, which is not sent by the non tlv targets. There is a minimum size check in the wmi event for non-tlv targets and hence we cannot update the common channel info structure as it was done in commit 13104929d2ec ("ath10k: fill the channel survey results for WCN3990 correctly"). This broke channel survey results on 10.x firmware versions. If the common channel info structure is updated, the size check for chan info event for non-tlv targets will fail and return -EPROTO and we see the below error messages ath10k_pci 0000:01:00.0: failed to parse chan info event: -71 Add tlv specific channel info structure and restore the original size of the common channel info structure to mitigate this issue. Tested HW: WCN3990 QCA9887 Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 10.2.4-1.0-00037 Fixes: 13104929d2ec ("ath10k: fill the channel survey results for WCN3990 correctly") Cc: [email protected] # 5.0 Signed-off-by: Rakesh Pillai <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12ath10k: adjust skb length in ath10k_sdio_mbox_rx_packetNicolas Boichat1-8/+21
When the FW bundles multiple packets, pkt->act_len may be incorrect as it refers to the first packet only (however, the FW will only bundle packets that fit into the same pkt->alloc_len). Before this patch, the skb length would be set (incorrectly) to pkt->act_len in ath10k_sdio_mbox_rx_packet, and then later manually adjusted in ath10k_sdio_mbox_rx_process_packet. The first problem is that ath10k_sdio_mbox_rx_process_packet does not use proper skb_put commands to adjust the length (it directly changes skb->len), so we end up with a mismatch between skb->head + skb->tail and skb->data + skb->len. This is quite serious, and causes corruptions in the TCP stack, as the stack tries to coalesce packets, and relies on skb->tail being correct (that is, skb_tail_pointer must point to the first byte_after_ the data). Instead of re-adjusting the size in ath10k_sdio_mbox_rx_process_packet, this moves the code to ath10k_sdio_mbox_rx_packet, and also add a bounds check, as skb_put would crash the kernel if not enough space is available. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Fixes: 8530b4e7b22bc3b ("ath10k: sdio: set skb len for all rx packets") Signed-off-by: Nicolas Boichat <[email protected]> Signed-off-by: Wen Gong <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-12ath10k: free beacon buf later in vdev teardownBen Greear1-4/+5
My wave-1 firmware often crashes when I am bringing down AP vdevs, and sometimes at least some machines lockup hard after spewing IOMMU errors. I don't see the same issue in STA mode, so I suspect beacons are the issue. Moving the beacon buf deletion to later in the vdev teardown logic appears to help this problem. Firmware still crashes often, but several iterations did not show IOMMU errors and machine didn't hang. Tested hardware: QCA9880 Tested firmware: ath10k-ct from beginning of 2019, exact version unknown Signed-off-by: Ben Greear <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-10ath9k: release allocated buffer if timed outNavid Emamdoost1-0/+1
In ath9k_wmi_cmd, the allocated network buffer needs to be released if timeout happens. Otherwise memory will be leaked. Signed-off-by: Navid Emamdoost <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-10ath9k_htc: release allocated buffer if timed outNavid Emamdoost1-0/+3
In htc_config_pipe_credits, htc_setup_complete, and htc_connect_service if time out happens, the allocated buffer needs to be released. Otherwise there will be memory leak. Signed-off-by: Navid Emamdoost <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-10ath9k: Remove unneeded variable to store return valuezhong jiang1-3/+1
ath9k_reg_rmw_single do not need return value to cope with different cases. And change functon return type to void. Signed-off-by: zhong jiang <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-10ath10k: add reorder and change PN check logic for mac80211Wen Gong1-2/+89
For sdio chip, if the rssi is not good, then it have some retry, firmware will indicate the msdu list of a ppdu with a hole, it means it lost the hole msdu, after the msdu retry from AP, the hole msdu will indicate from firmware later. The hole msdu's PN check will fail and the hole msdu will be dropped. PN check fail example: Sequence number PN number PN check status 3814 6101 success 3815 6102 success 3816 6103 success 3818 6105 success 3819 6106 success 3820 6107 success 3817 6104 fail The correct logic is reorder the msdu list and then do PN check. ieee80211_rx_reorder_ampdu of mac80211 will do the reorer logic and then do PN check in ieee80211_rx_h_decrypt of mac80211. example after reorder: Sequence number PN number PN check status 3814 6101 success 3815 6102 success 3816 6103 success 3817 6104 success 3818 6105 success 3819 6106 success 3820 6107 success Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00017-QCARMSWP-1. Signed-off-by: Wen Gong <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-10ath10k: add mic bytes for pmf management packetWen Gong1-0/+8
For PMF case, the action,deauth,disassoc management need to encrypt by hardware, it need to reserve 8 bytes for encryption, otherwise the packet will be sent out with error format, then PMF case will fail. After add the 8 bytes, it will pass the PMF case. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00005-QCARMSWP-1. Signed-off-by: Wen Gong <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()Hui Peng1-0/+8
The `ar_usb` field of `ath6kl_usb_pipe_usb_pipe` objects are initialized to point to the containing `ath6kl_usb` object according to endpoint descriptors read from the device side, as shown below in `ath6kl_usb_setup_pipe_resources`: for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { endpoint = &iface_desc->endpoint[i].desc; // get the address from endpoint descriptor pipe_num = ath6kl_usb_get_logical_pipe_num(ar_usb, endpoint->bEndpointAddress, &urbcount); ...... // select the pipe object pipe = &ar_usb->pipes[pipe_num]; // initialize the ar_usb field pipe->ar_usb = ar_usb; } The driver assumes that the addresses reported in endpoint descriptors from device side to be complete. If a device is malicious and does not report complete addresses, it may trigger NULL-ptr-deref `ath6kl_usb_alloc_urb_from_pipe` and `ath6kl_usb_free_urb_to_pipe`. This patch fixes the bug by preventing potential NULL-ptr-deref (CVE-2019-15098). Signed-off-by: Hui Peng <[email protected]> Reported-by: Hui Peng <[email protected]> Reported-by: Mathias Payer <[email protected]> Reviewed-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04wcn36xx: use dynamic allocation for large variablesArnd Bergmann1-81/+105
clang triggers a warning about oversized stack frames that gcc does not notice because of slightly different inlining decisions: ath/wcn36xx/smd.c:1409:5: error: stack frame size of 1040 bytes in function 'wcn36xx_smd_config_bss' [-Werror,-Wframe-larger-than=] ath/wcn36xx/smd.c:640:5: error: stack frame size of 1032 bytes in function 'wcn36xx_smd_start_hw_scan' [-Werror,-Wframe-larger-than=] Basically the wcn36xx_hal_start_scan_offload_req_msg, wcn36xx_hal_config_bss_req_msg_v1, and wcn36xx_hal_config_bss_req_msg structures are too large to be put on the kernel stack, but small enough that gcc does not warn about them. Use kzalloc() to allocate them all. There are similar structures in other parts of this driver, but they are all smaller, with the next largest stack frame at 480 bytes for wcn36xx_smd_send_beacon. Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04ath6kl: Fix a possible null-pointer dereference in ath6kl_htc_mbox_create()Jia-Ju Bai1-2/+2
In ath6kl_htc_mbox_create(), when kzalloc() on line 2855 fails, target->dev is assigned to NULL, and ath6kl_htc_mbox_cleanup(target) is called on line 2885. In ath6kl_htc_mbox_cleanup(), target->dev is used on line 2895: ath6kl_hif_cleanup_scatter(target->dev->ar); Thus, a null-pointer dereference may occur. To fix this bug, kfree(target) is called and NULL is returned when kzalloc() on line 2855 fails. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04ath9k: dynack: set ackto to max timeout in ath_dynack_resetLorenzo Bianconi1-7/+13
Initialize acktimeout to the maximum configurable value in ath_dynack_reset in order to not disconnect long distance static links enabling dynack and even to take care of possible errors configuring a static timeout. Moreover initialize station timeout value to the current acktimeout value Tested-by: Koen Vandeputte <[email protected]> Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04ath9k: dynack: set max timeout according to channel widthLorenzo Bianconi1-8/+30
Compute maximum configurable ackimeout/ctstimeout according to channel width (clockrate) Tested-by: Koen Vandeputte <[email protected]> Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04ath9k: dynack: properly set last timeout timestamp in ath_dynack_resetLorenzo Bianconi1-1/+1
Add compute timeout to last computation timestamp in ath_dynack_reset in order to not run ath_dynack_compute_ackto immediately Tested-by: Koen Vandeputte <[email protected]> Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04ath9k: dyanck: introduce ath_dynack_set_timeout routineLorenzo Bianconi1-16/+21
Introduce ath_dynack_set_timeout routine to configure slottime/ack/cts timeouts and remove duplicated code Tested-by: Koen Vandeputte <[email protected]> Signed-off-by: Lorenzo Bianconi <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}initLorenzo Bianconi1-4/+4
Fix following lockdep warning disabling bh in ath_dynack_node_init/ath_dynack_node_deinit [ 75.955878] -------------------------------- [ 75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. [ 75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes: [ 75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] [ 75.955905] {SOFTIRQ-ON-W} state was registered at: [ 75.955912] lock_acquire+0x9a/0x160 [ 75.955917] _raw_spin_lock+0x2c/0x70 [ 75.955927] ath_dynack_node_init+0x2a/0x60 [ath9k_hw] [ 75.955934] ath9k_sta_state+0xec/0x160 [ath9k] [ 75.955976] drv_sta_state+0xb2/0x740 [mac80211] [ 75.956008] sta_info_insert_finish+0x21a/0x420 [mac80211] [ 75.956039] sta_info_insert_rcu+0x12b/0x2c0 [mac80211] [ 75.956069] sta_info_insert+0x7/0x70 [mac80211] [ 75.956093] ieee80211_prep_connection+0x42e/0x730 [mac80211] [ 75.956120] ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211] [ 75.956152] cfg80211_mlme_auth+0x143/0x350 [cfg80211] [ 75.956169] nl80211_authenticate+0x25e/0x2b0 [cfg80211] [ 75.956172] genl_family_rcv_msg+0x198/0x400 [ 75.956174] genl_rcv_msg+0x42/0x90 [ 75.956176] netlink_rcv_skb+0x35/0xf0 [ 75.956178] genl_rcv+0x1f/0x30 [ 75.956180] netlink_unicast+0x154/0x200 [ 75.956182] netlink_sendmsg+0x1bf/0x3d0 [ 75.956186] ___sys_sendmsg+0x2c2/0x2f0 [ 75.956187] __sys_sendmsg+0x44/0x80 [ 75.956190] do_syscall_64+0x55/0x1a0 [ 75.956192] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 75.956194] irq event stamp: 2357092 [ 75.956196] hardirqs last enabled at (2357092): [<ffffffff818c62de>] _raw_spin_unlock_irqrestore+0x3e/0x50 [ 75.956199] hardirqs last disabled at (2357091): [<ffffffff818c60b1>] _raw_spin_lock_irqsave+0x11/0x80 [ 75.956202] softirqs last enabled at (2357072): [<ffffffff8106dc09>] irq_enter+0x59/0x60 [ 75.956204] softirqs last disabled at (2357073): [<ffffffff8106dcbe>] irq_exit+0xae/0xc0 [ 75.956206] other info that might help us debug this: [ 75.956207] Possible unsafe locking scenario: [ 75.956208] CPU0 [ 75.956209] ---- [ 75.956210] lock(&(&da->qlock)->rlock); [ 75.956213] <Interrupt> [ 75.956214] lock(&(&da->qlock)->rlock); [ 75.956216] *** DEADLOCK *** [ 75.956217] 1 lock held by swapper/0/0: [ 75.956219] #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k] [ 75.956225] stack backtrace: [ 75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13 [ 75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009 [ 75.956231] Call Trace: [ 75.956233] <IRQ> [ 75.956236] dump_stack+0x67/0x90 [ 75.956239] mark_lock+0x4c1/0x640 [ 75.956242] ? check_usage_backwards+0x130/0x130 [ 75.956245] ? sched_clock_local+0x12/0x80 [ 75.956247] __lock_acquire+0x484/0x7a0 [ 75.956250] ? __lock_acquire+0x3b9/0x7a0 [ 75.956252] lock_acquire+0x9a/0x160 [ 75.956259] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] [ 75.956262] _raw_spin_lock_bh+0x34/0x80 [ 75.956268] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] [ 75.956275] ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] [ 75.956280] ath_rx_tasklet+0xd09/0xe90 [ath9k] [ 75.956286] ath9k_tasklet+0x102/0x240 [ath9k] [ 75.956288] tasklet_action_common.isra.0+0x6d/0x170 [ 75.956291] __do_softirq+0xcc/0x425 [ 75.956294] irq_exit+0xae/0xc0 [ 75.956296] do_IRQ+0x8a/0x110 [ 75.956298] common_interrupt+0xf/0xf [ 75.956300] </IRQ> [ 75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400 [ 75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7 [ 75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000 [ 75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800 [ 75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000 [ 75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 [ 75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800 [ 75.956321] cpuidle_enter+0x24/0x40 [ 75.956323] do_idle+0x1ac/0x220 [ 75.956326] cpu_startup_entry+0x14/0x20 [ 75.956329] start_kernel+0x482/0x489 [ 75.956332] secondary_startup_64+0xa4/0xb0 Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation") Signed-off-by: Lorenzo Bianconi <[email protected]> Tested-by: Koen Vandeputte <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04ath9k: add loader for AR92XX (and older) pci(e)Christian Lamparter3-0/+233
Atheros cards with a AR92XX generation (and older) chip usually store their pci(e) initialization vectors on an external eeprom chip. However these chips technically don't need the eeprom chip attached, the AR9280 Datasheet in section "6.1.2 DEVICE_ID" describes that "... if the EEPROM content is not valid, a value of 0xFF1C returns when read from the register". So, they will show up on the system's pci bus. However in that state, ath9k can't load, since it relies on having the correct pci-id, otherwise it doesn't know what chip it actually is. This happens on many embedded devices like routers and accesspoint since they want to keep the BOM low and store the pci(e) initialization vectors together with the calibration data on the system's FLASH, which is out of reach of the ath9k chip. Furthermore, Some devices (like the Cisco Meraki Z1 Cloud Managed Teleworker Gateway) need to be able to initialize the PCIe wifi device. Normally, this should be done as a pci quirk during the early stages of booting linux. However, this isn't possible for devices which have the init code for the Atheros chip stored on NAND in an UBI volume. Hence, this module can be used to initialize the chip when the user-space is ready to extract the init code. Martin Blumenstingl prodived the following fixes: owl-loader: add support for OWL emulation PCI devices owl-loader: don't re-scan the bus when ath9k_pci_fixup failed owl-loader: use dev_* instead of pr_* logging functions owl-loader: auto-generate the eeprom filename as fallback owl-loader: add a debug message when swapping the eeprom data owl-loader: add missing newlines in log messages Reviewed-by: Julian Calaby <[email protected]> Signed-off-by: Christian Lamparter <[email protected]> Signed-off-by: Martin Blumenstingl <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04carl9170: remove set but not used variable 'udev'YueHaibing1-2/+0
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/ath/carl9170/usb.c: In function carl9170_usb_disconnect: drivers/net/wireless/ath/carl9170/usb.c:1110:21: warning: variable udev set but not used [-Wunused-but-set-variable] It is not use since commit feb09b293327 ("carl9170: fix misuse of device driver API") Reported-by: Hulk Robot <[email protected]> Signed-off-by: YueHaibing <[email protected]> Acked-by: Christian Lamparter <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04wil6210: Delete an unnecessary kfree() call in wil_tid_ampdu_rx_alloc()Markus Elfring1-1/+0
A null pointer would be passed to a call of the function “kfree” directly after a call of the function “kcalloc” failed at one place. Remove this superfluous function call. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <[email protected]> Reviewed-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04wil6210: Add EDMG channel supportAlexei Avshalom Lazar6-13/+240
Add support for Enhanced Directional Multi-Gigabit (EDMG) channels 9-11. wil6210 reports it's EDMG capabilities (that are also based on FW capability) to cfg80211 by filling wiphy->bands[NL80211_BAND_60GHZ]->edmg_cap. wil6210 handles edmg.channels and edmg.bw_config requested in connect and start_ap operations. Signed-off-by: Alexei Avshalom Lazar <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-09-04wil6210: fix wil_cid_valid with negative cid valuesColin Ian King1-1/+1
There are several occasions where a negative cid value is passed into wil_cid_valid and this is converted into a u8 causing the range check of cid >= 0 to always succeed. Fix this by making the cid argument an int to handle any -ve error value of cid. An example of this behaviour is in wil_cfg80211_dump_station, where cid is assigned -ENOENT if the call to wil_find_cid_by_idx fails, and this -ve value is passed to wil_cid_valid. I believe that the conversion of -ENOENT to the u8 value 254 which is greater than wil->max_assoc_sta causes wil_find_cid_by_idx to currently work fine, but I think is by luck and not the intended behaviour. Signed-off-by: Colin Ian King <[email protected]> Reviewed-by: Maya Erez <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-08-28PCI: Move ASPM declarations to linux/pci.hKrzysztof Wilczynski1-1/+0
Move ASPM definitions and function prototypes from include/linux/pci-aspm.h to include/linux/pci.h so users only need to include <linux/pci.h>: PCIE_LINK_STATE_L0S PCIE_LINK_STATE_L1 PCIE_LINK_STATE_CLKPM pci_disable_link_state() pci_disable_link_state_locked() pcie_no_aspm() No functional changes intended. Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Krzysztof Wilczynski <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]>
2019-08-21nl80211: Add support for EDMG channelsAlexei Avshalom Lazar1-1/+1
802.11ay specification defines Enhanced Directional Multi-Gigabit (EDMG) STA and AP which allow channel bonding of 2 channels and more. Introduce new NL attributes that are needed for enabling and configuring EDMG support. Two new attributes are used by kernel to publish driver's EDMG capabilities to the userspace: NL80211_BAND_ATTR_EDMG_CHANNELS - bitmap field that indicates the 2.16 GHz channel(s) that are supported by the driver. When this attribute is not set it means driver does not support EDMG. NL80211_BAND_ATTR_EDMG_BW_CONFIG - represent the channel bandwidth configurations supported by the driver. Additional two new attributes are used by the userspace for connect command and for AP configuration: NL80211_ATTR_WIPHY_EDMG_CHANNELS NL80211_ATTR_WIPHY_EDMG_BW_CONFIG New rate info flag - RATE_INFO_FLAGS_EDMG, can be reported from driver and used for bitrate calculation that will take into account EDMG according to the 802.11ay specification. Signed-off-by: Alexei Avshalom Lazar <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Johannes Berg <[email protected]>
2019-07-26mac80211: pass the vif to cancel_remain_on_channelEmmanuel Grumbach2-2/+4
This low level driver can find it useful to get the vif when a remain on channel session is cancelled. iwlwifi will need this soon. Signed-off-by: Emmanuel Grumbach <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Johannes Berg <[email protected]>
2019-07-22net: Use skb accessors in network driversMatthew Wilcox (Oracle)3-8/+6
In preparation for unifying the skb_frag and bio_vec, use the fine accessors which already exist and use skb_frag_t instead of struct skb_frag_struct. Signed-off-by: Matthew Wilcox (Oracle) <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2019-07-20wireless: fix nl80211 vendor commandsJohannes Berg1-0/+4
In my previous commit to validate a policy I neglected to actually add one to the few drivers using vendor commands, fix that now. Reported-by: Tony Lindgren <[email protected]> Tested-by: Tony Lindgren <[email protected]> Fixes: 901bb9891855 ("nl80211: require and validate vendor command policy") Signed-off-by: Johannes Berg <[email protected]>
2019-07-15ath10k: work around uninitialized vht_pfr variableArnd Bergmann1-0/+2
As clang points out, the vht_pfr is assigned to a struct member without being initialized in one case: drivers/net/wireless/ath/ath10k/mac.c:7528:7: error: variable 'vht_pfr' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] if (!ath10k_mac_can_set_bitrate_mask(ar, band, mask, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath10k/mac.c:7551:20: note: uninitialized use occurs here arvif->vht_pfr = vht_pfr; ^~~~~~~ drivers/net/wireless/ath/ath10k/mac.c:7528:3: note: remove the 'if' if its condition is always true if (!ath10k_mac_can_set_bitrate_mask(ar, band, mask, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath10k/mac.c:7483:12: note: initialize the variable 'vht_pfr' to silence this warning u8 vht_pfr; Add an explicit but probably incorrect initialization here. I suspect we want a better fix here, but chose this approach to illustrate the issue. Fixes: 8b97b055dc9d ("ath10k: fix failure to set multiple fixed rate") Signed-off-by: Arnd Bergmann <[email protected]> Reviewed-by: Nathan Chancellor <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2019-07-08Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller15-15/+15
Two cases of overlapping changes, nothing fancy. Signed-off-by: David S. Miller <[email protected]>
2019-07-01Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo39-227/+832
ath.git patches for 5.3. Major changes: ath10k * fixes for SDIO support * add support for firmware logging via WMI
2019-06-28ath10k: pci: remove unnecessary castsKalle Valo1-10/+6
Fixes checkpatch warnings: drivers/net/wireless/ath/ath10k/pci.c:926: unnecessary cast may hide bugs, see http://c-faq.com/malloc/mallocnocast.html drivers/net/wireless/ath/ath10k/pci.c:1072: unnecessary cast may hide bugs, see http://c-faq.com/malloc/mallocnocast.html While at it, also remove unnecessary initialisation of data_buf variable in both cases. Signed-off-by: Kalle Valo <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.