- 13 May, 2022 14 commits
-
-
Lorenzo Bianconi authored
Fix the following smatch static checker warning: drivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1872 mt7915_mcu_beacon_mbss() error: undefined (user controlled) shift '(((1))) << (data[2])' Rely on mac80211 definitions for ieee80211_bssid_index subelement. Fixes: 6b7f9aff ("mt76: mt7915: introduce 802.11ax multi-bss support") Signed-off-by:
Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by:
Felix Fietkau <nbd@nbd.name>
-
Ryder Lee authored
Soft reboot might not clear certain condition, so always call mt7915_wfsys_reset() during init. Signed-off-by:
Ryder Lee <ryder.lee@mediatek.com> Signed-off-by:
-
Lorenzo Bianconi authored
Honor runtime-pm user configuration in mt7921_sniffer_interface_iter routine if we do not have a monitor interface. Fixes: 1f12fa34 ("mt76: mt7921: don't enable beacon filter when IEEE80211_CONF_CHANGE_MONITOR is set") Signed-off-by:
-
Lorenzo Bianconi authored
mt7921 is currently using rxfilter defined in mt76_dev for rx filter configuration. Fix mt7921_configure_filter implementation. Signed-off-by:
-
Lorenzo Bianconi authored
Introduce suspend/resume callbacks for mt7921u driver. Tested-by:
Deren Wu <deren.wu@mediatek.com> Signed-off-by:
-
Evelyn Tsai authored
MT7915_MAX_INTERFACES is per-band declaration in MT7915/MT7986/MT7916. Enlarge vif_mask to 64 bits wide, including the bit operation. Reviewed-by:
Shayne Chen <shayne.chen@mediatek.com> Signed-off-by:
Evelyn Tsai <evelyn.tsai@mediatek.com> Signed-off-by:
Bo Jiao <bo.jiao@mediatek.com> Signed-off-by:
-
Felix Fietkau authored
Fixes an issue caught by KASAN about use-after-free in mt76_txq_schedule by protecting mtxq->wcid with rcu_lock between mt76_txq_schedule and sta_info_[alloc, free]. [18853.876689] ================================================================== [18853.876751] BUG: KASAN: use-after-free in mt76_txq_schedule+0x204/0xaf8 [mt76] [18853.876773] Read of size 8 at addr ffffffaf989a2138 by task mt76-tx phy0/883 [18853.876786] [18853.876810] CPU: 5 PID: 883 Comm: mt76-tx phy0 Not tainted 5.10.100-fix-510-56778d365941-kasan #5 0b01fbbcf41a530f52043508fec2e31a4215 [18853.876840] Call trace: [18853.876861] dump_backtrace+0x0/0x3ec [18853.876878] show_stack+0x20/0x2c [18853.876899] dump_stack+0x11c/0x1ac [18853.876918] print_address_description+0x74/0x514 [18853.876934] kasan_report+0x134/0x174 [18853.876948] __asan_report_load8_noabort+0x44/0x50 [18853.876976] mt76_txq_schedule+0x204/0xaf8 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877002] mt76_txq_schedule_all+0x2c/0x48 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877030] mt7921_tx_worker+0xa0/0x1cc [mt7921_common f0875ebac9d7b4754e1010549e7db50fbd90a047] [18853.877054] __mt76_worker_fn+0x190/0x22c [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877071] kthread+0x2f8/0x3b8 [18853.877087] ret_from_fork+0x10/0x30 [18853.877098] [18853.877112] Allocated by task 941: [18853.877131] kasan_save_stack+0x38/0x68 [18853.877147] __kasan_kmalloc+0xd4/0xfc [18853.877163] kasan_kmalloc+0x10/0x1c [18853.877177] __kmalloc+0x264/0x3c4 [18853.877294] sta_info_alloc+0x460/0xf88 [mac80211] [18853.877410] ieee80211_prep_connection+0x204/0x1ee0 [mac80211] [18853.877523] ieee80211_mgd_auth+0x6c4/0xa4c [mac80211] [18853.877635] ieee80211_auth+0x20/0x2c [mac80211] [18853.877733] rdev_auth+0x7c/0x438 [cfg80211] [18853.877826] cfg80211_mlme_auth+0x26c/0x390 [cfg80211] [18853.877919] nl80211_authenticate+0x6d4/0x904 [cfg80211] [18853.877938] genl_rcv_msg+0x748/0x93c [18853.877954] netlink_rcv_skb+0x160/0x2a8 [18853.877969] genl_rcv+0x3c/0x54 [18853.877985] netlink_unicast_kernel+0x104/0x1ec [18853.877999] netlink_unicast+0x178/0x268 [18853.878015] netlink_sendmsg+0x3cc/0x5f0 [18853.878030] sock_sendmsg+0xb4/0xd8 [18853.878043] ____sys_sendmsg+0x2f8/0x53c [18853.878058] ___sys_sendmsg+0xe8/0x150 [18853.878071] __sys_sendmsg+0xc4/0x1f4 [18853.878087] __arm64_compat_sys_sendmsg+0x88/0x9c [18853.878101] el0_svc_common+0x1b4/0x390 [18853.878115] do_el0_svc_compat+0x8c/0xdc [18853.878131] el0_svc_compat+0x10/0x1c [18853.878146] el0_sync_compat_handler+0xa8/0xcc [18853.878161] el0_sync_compat+0x188/0x1c0 [18853.878171] [18853.878183] Freed by task 10927: [18853.878200] kasan_save_stack+0x38/0x68 [18853.878215] kasan_set_track+0x28/0x3c [18853.878228] kasan_set_free_info+0x24/0x48 [18853.878244] __kasan_slab_free+0x11c/0x154 [18853.878259] kasan_slab_free+0x14/0x24 [18853.878273] slab_free_freelist_hook+0xac/0x1b0 [18853.878287] kfree+0x104/0x390 [18853.878402] sta_info_free+0x198/0x210 [mac80211] [18853.878515] __sta_info_destroy_part2+0x230/0x2d4 [mac80211] [18853.878628] __sta_info_flush+0x300/0x37c [mac80211] [18853.878740] ieee80211_set_disassoc+0x2cc/0xa7c [mac80211] [18853.878851] ieee80211_mgd_deauth+0x4a4/0x10a0 [mac80211] [18853.878962] ieee80211_deauth+0x20/0x2c [mac80211] [18853.879057] rdev_deauth+0x7c/0x438 [cfg80211] [18853.879150] cfg80211_mlme_deauth+0x274/0x414 [cfg80211] [18853.879243] cfg80211_mlme_down+0xe4/0x118 [cfg80211] [18853.879335] cfg80211_disconnect+0x218/0x2d8 [cfg80211] [18853.879427] __cfg80211_leave+0x17c/0x240 [cfg80211] [18853.879519] cfg80211_leave+0x3c/0x58 [cfg80211] [18853.879611] wiphy_suspend+0xdc/0x200 [cfg80211] [18853.879628] dpm_run_callback+0x58/0x408 [18853.879642] __device_suspend+0x4cc/0x864 [18853.879658] async_suspend+0x34/0xf4 [18853.879673] async_run_entry_fn+0xe0/0x37c [18853.879689] process_one_work+0x508/0xb98 [18853.879702] worker_thread+0x7f4/0xcd4 [18853.879717] kthread+0x2f8/0x3b8 [18853.879731] ret_from_fork+0x10/0x30 [18853.879741] [18853.879757] The buggy address belongs to the object at ffffffaf989a2000 [18853.879757] which belongs to the cache kmalloc-8k of size 8192 [18853.879774] The buggy address is located 312 bytes inside of [18853.879774] 8192-byte region [ffffffaf989a2000, ffffffaf989a4000) [18853.879787] The buggy address belongs to the page: [18853.879807] page:000000004bda2a59 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d89a0 [18853.879823] head:000000004bda2a59 order:3 compound_mapcount:0 compound_pincount:0 [18853.879839] flags: 0x8000000000010200(slab|head) [18853.879857] raw: 8000000000010200 ffffffffbc89e208 ffffffffb7fb5208 ffffffaec000cc80 [18853.879873] raw: 0000000000000000 0000000000010001 00000001ffffffff 0000000000000000 [18853.879885] page dumped because: kasan: bad access detected [18853.879896] [18853.879907] Memory state around the buggy address: [18853.879922] ffffffaf989a2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879935] ffffffaf989a2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879948] >ffffffaf989a2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879961] ^ [18853.879973] ffffffaf989a2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879986] ffffffaf989a2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879998] ================================================================== Cc: stable@vger.kernel.org Reported-by:
Sean Wang <sean.wang@mediatek.com> Signed-off-by:
-
Felix Fietkau authored
The hardware receives them properly, they should not be dropped Signed-off-by: -
Felix Fietkau authored
The hardware receives them properly, they should not be dropped Signed-off-by: -
Felix Fietkau authored
dma unmap is already needed for cleanup anyway, so we don't need the extra tracking and can save a bit of memory here Signed-off-by: -
Felix Fietkau authored
- call txq dequeue without holding txq lock (locking handled by mac80211) - disable bh around tx queue schedule Signed-off-by: -
Felix Fietkau authored
Clean up and fix error paths in mt7915_register_device Initialize second DBDC tx queue in mt7915_dma_init Signed-off-by: -
Felix Fietkau authored
This code was accidentally dropped while adding 6 GHz support Fixes: b4d093e3 ("mt76: mt7915: add 6 GHz support") Signed-off-by:
-
Dongliang Mu authored
This memory allocation failure can be triggered by fault injection or high pressure testing, resulting a WARN. Fix this by replacing WARN with pr_warn. Reported-by:
syzkaller <syzkaller@googlegroups.com> Signed-off-by:
Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220511014453.1621366-1-dzm91@hust.edu.cn
-
- 11 May, 2022 13 commits
-
-
Jaehee Park authored
Currently, upon virtual interface creation, wfx_add_interface() stores a reference to the corresponding struct ieee80211_vif in private data, for later usage. This is not needed when using the container_of construct. This construct already has all the info it needs to retrieve the reference to the corresponding struct from the offset that is already available, inherent in container_of(), between its type and member inputs (struct ieee80211_vif and drv_priv, respectively). Remove vif (which was previously storing the reference to the struct ieee80211_vif) from the struct wfx_vif, define a function wvif_to_vif(wvif) for container_of(), and replace all wvif->vif with the newly defined container_of construct. Signed-off-by:
Jaehee Park <jhpark1013@gmail.com> Signed-off-by:
-
Ping-Ke Shih authored
BSSID CAM is a kind of CAM that is used to determine if we receive a packet or not. Add an entry to assist in debugging. Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
-
Ping-Ke Shih authored
Dump new region 0x3000 to 0x33ff to help debug. Signed-off-by:
-
Ping-Ke Shih authored
EDCCA signal can block transmitting in certain situation, so ignore this signal and use others to decide transmitting time. Signed-off-by:
-
Ping-Ke Shih authored
Set proper setting according to RX quota, and then it doesn't break buffer due to size of received packet exceeding buffer size. Signed-off-by:
-
Hsuan Hung authored
Modify NBI and PD boost settings according to different primary channels. This setting can decrease the false alarm induced by DC. Signed-off-by:
Hsuan Hung <hsuan8331@realtek.com> Signed-off-by:
-
Jiapeng Chong authored
Clean up the following smatch warning: drivers/ssb/pci.c:917 ssb_pci_sprom_get() warn: ignoring unreachable code. Reported-by:
Abaci Robot <abaci@linux.alibaba.com> Signed-off-by:
Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Acked-by:
Michael Büsch <m@bues.ch> Signed-off-by:
-
Pavel Löbl authored
This allows firmware to provide MAC address using device tree. Like in case there is no MAC burned in wlan NVRAM. Signed-off-by:
Pavel Löbl <pavel@loebl.cz> Signed-off-by:
-
Ajay Singh authored
'vmm_table' array contains the size of data buffer length including host header length. In 'vmm_table' array, the Zero value means the end of vmm_entries that needs to transfer to firmware which is calculated based on VMM free size in firmware. Use 'vmm_table' valid entry check before fetching the entry from TX queue to only copy valid number of entries to avoid possible NULL pointer exception observed sometimes during large file transfers. Signed-off-by:
Ajay Singh <ajay.kathat@microchip.com> Signed-off-by:
-
Ajay Singh authored
Use 'u64' instead of 'u32' for the cookie variable as expected by cfg80211 callback function argument. Signed-off-by:
-
Ajay Singh authored
Monitor(mon.) interface is used for handling the AP mode and 'ieee80211_ptr' reference is not getting set for it. Like earlier implementation, use register_netdevice() instead of cfg80211_register_netdevice() which expects valid 'ieee80211_ptr' reference to avoid the possible crash. Fixes: 2fe8ef10 ("cfg80211: change netdev registration/unregistration semantics") Signed-off-by:
-
Ajay Singh authored
The function number was not correct(reset to 0) when host resumes from suspend state. Use hardcoded value in function base information register(FBR base address) to re-initialize correctly on host resume. Signed-off-by:
-
Ajay Singh authored
Increase firmware version array size to hold complete version information. The firmware commit id(Build:) information is also part of the firmware version string. Firmware version format: WILC_WIFI_FW_REL_XX_XX Build: XXXXX e.g. WILC_WIFI_FW_REL_15_6 Build: 12804 Signed-off-by:
-
- 09 May, 2022 2 commits
-
-
Andy Shevchenko authored
GPIO library now accepts fwnode as a firmware node, so switch the driver to use it. Signed-off-by:
Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by:
-
Chin-Yen Lee authored
Fine tune algorithm of adaptivity sensitivity to avoid disconnecting from AP suddenly in field. Signed-off-by:
Chin-Yen Lee <timlee@realtek.com> Signed-off-by:
-
- 06 May, 2022 4 commits
-
-
H. Nikolaus Schaller authored
With introduction of vmap'ed stacks, stack parameters can no longer be used for DMA and now leads to kernel panic. It happens at several places for the wl1251 (e.g. when accessed through SDIO) making it unuseable on e.g. the OpenPandora. We solve this by allocating temporary buffers or use wl1251_read32(). Tested on v5.18-rc5 with OpenPandora. Fixes: a1c510d0 ("ARM: implement support for vmap'ed stacks") Signed-off-by:
H. Nikolaus Schaller <hns@goldelico.com> Signed-off-by:
-
Jakub Kicinski authored
qtnfmac chooses its own magic NAPI weight so switch to the new API created for those who don't use NAPI_POLL_WEIGHT. Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
-
Jakub Kicinski authored
Switch to the new API not requiring passing in NAPI_POLL_WEIGHT. Signed-off-by:
-
Jakub Kicinski authored
Switch to the new API not requiring passing in NAPI_POLL_WEIGHT. Signed-off-by:
-
- 04 May, 2022 7 commits
-
-
Muna Sinada authored
Allow userspace to disable EHT mode. This forces EHT capable interfaces to disable during association. Signed-off-by:
Muna Sinada <quic_msinada@quicinc.com> Signed-off-by:
Aloka Dixit <quic_alokad@quicinc.com> Link: https://lore.kernel.org/r/20220323224636.20211-2-quic_alokad@quicinc.com [remove stray message change] Signed-off-by:
Johannes Berg <johannes.berg@intel.com>
-
Muna Sinada authored
Allow userspace to disable EHT mode during association. Signed-off-by:
-
Felix Fietkau authored
In client mode, we can't connect to hidden SSID APs or SSIDs not advertised in beacons on DFS channels, since we're forced to passive scan. Fix this by sending out a probe request immediately after the first beacon, if active scan was requested by the user. Cc: stable@vger.kernel.org Reported-by:
Catrinel Catrinescu <cc@80211.de> Signed-off-by:
-
Hangyu Hua authored
If statement is meaningless because the code will goto out regardless of whether fast_tx is NULL or not. Signed-off-by:
Hangyu Hua <hbh25y@gmail.com> Link: https://lore.kernel.org/r/20220413091902.27438-1-hbh25y@gmail.comSigned-off-by:
-
Ping-Ke Shih authored
Follow IEEE 802.11-21 that HTC subfield masked to 0 for all data frames containing a QoS Control field. It also defines the AAD length depends on QC and A4 fields, so change logic to determine length accordingly. Signed-off-by:
-
Dimitri John Ledkov authored
Add MODULE_FIRMWARE declarations for regulatory.db and regulatory.db.p7s such that userspace tooling can discover and include these files. Cc: stable@vger.kernel.org Signed-off-by:
Dimitri John Ledkov <dimitri.ledkov@canonical.com> Link: https://lore.kernel.org/r/20220414125004.267819-1-dimitri.ledkov@canonical.comSigned-off-by:
-
Johannes Berg authored
Since internal_flags is only 8 bits, we can only have one more internal flag. However, we can obviously never use all of possible the combinations, in fact, we only use 14 of them (including no flags). Since we want more flags for MLO (multi-link operation) in the future, refactor the code to use a flags selector, so wrap all of the .internal_flags assignments in a IFLAGS() macro which selects the combination according to the pre- defined list of combinations. When we need a new combination, we'll have to add it, but again we will never use all possible combinations. Signed-off-by:
-
