mac80211: Update to version 4.19.120

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
Hauke Mehrtens 2020-03-21 20:24:00 +01:00 committed by CN_SZTL
parent 36fde38f7a
commit 1495a90ae3
No known key found for this signature in database
GPG Key ID: 6850B6345C862176
46 changed files with 121 additions and 421 deletions

View File

@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=mac80211
PKG_VERSION:=4.19.98-1
PKG_VERSION:=4.19.120-1
PKG_RELEASE:=1
PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v4.19.98/
PKG_HASH:=256d77e9cd3918d6a361e029850aba4568e8a00167ab3ed55495a359511c5bd2
PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v4.19.120/
PKG_HASH:=2bafd75da301a30a5f2b98f433b6545d7b58c1fc3af15e9e9aa085df7f9db1d4
PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)

View File

@ -1,6 +1,6 @@
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -3027,6 +3027,8 @@ void regulatory_hint_country_ie(struct w
@@ -3034,6 +3034,8 @@ void regulatory_hint_country_ie(struct w
enum environment_cap env = ENVIRON_ANY;
struct regulatory_request *request = NULL, *lr;
@ -9,7 +9,7 @@
/* IE len must be evenly divisible by 2 */
if (country_ie_len & 0x01)
return;
@@ -3252,6 +3254,7 @@ static bool is_wiphy_all_set_reg_flag(en
@@ -3259,6 +3261,7 @@ static bool is_wiphy_all_set_reg_flag(en
void regulatory_hint_disconnect(void)
{

View File

@ -29,7 +29,7 @@ Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
- an->ackto = ackto;
+ an->ackto = da->ackto;
spin_lock(&da->qlock);
spin_lock_bh(&da->qlock);
list_add_tail(&an->list, &da->nodes);
@@ -356,20 +354,26 @@ EXPORT_SYMBOL(ath_dynack_node_deinit);
*/

View File

@ -39,7 +39,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
num = 0;
/* Validate all the subframe headers */
@@ -3422,7 +3421,6 @@ static int brcmf_sdio_bus_preinit(struct
@@ -3426,7 +3425,6 @@ static int brcmf_sdio_bus_preinit(struct
struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
struct brcmf_sdio *bus = sdiodev->bus;
struct brcmf_core *core = bus->sdio_core;
@ -47,7 +47,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
u32 value;
int err;
@@ -3465,7 +3463,6 @@ static int brcmf_sdio_bus_preinit(struct
@@ -3467,7 +3465,6 @@ static int brcmf_sdio_bus_preinit(struct
if (sdiodev->sg_support) {
bus->txglom = false;
value = 1;

View File

@ -67,7 +67,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
fwreq->bus_nr = devinfo->pdev->bus->number;
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4210,6 +4210,7 @@ brcmf_sdio_prepare_fw_request(struct brc
@@ -4213,6 +4213,7 @@ brcmf_sdio_prepare_fw_request(struct brc
fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;

View File

@ -20,7 +20,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -972,6 +972,7 @@ static const struct sdio_device_id brcmf
@@ -970,6 +970,7 @@ static const struct sdio_device_id brcmf
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4356),
BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_CYPRESS_4373),
@ -100,7 +100,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
if (on) {
/* device WAKEUP through KSO:
* write bit 0 & read back until
@@ -2413,6 +2423,14 @@ static int brcmf_sdio_tx_ctrlframe(struc
@@ -2414,6 +2424,14 @@ static int brcmf_sdio_tx_ctrlframe(struc
return ret;
}
@ -115,7 +115,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
static void brcmf_sdio_bus_stop(struct device *dev)
{
struct brcmf_bus *bus_if = dev_get_drvdata(dev);
@@ -2420,7 +2438,7 @@ static void brcmf_sdio_bus_stop(struct d
@@ -2421,7 +2439,7 @@ static void brcmf_sdio_bus_stop(struct d
struct brcmf_sdio *bus = sdiodev->bus;
struct brcmf_core *core = bus->sdio_core;
u32 local_hostintmask;
@ -124,7 +124,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
int err;
brcmf_dbg(TRACE, "Enter\n");
@@ -2447,9 +2465,14 @@ static void brcmf_sdio_bus_stop(struct d
@@ -2448,9 +2466,14 @@ static void brcmf_sdio_bus_stop(struct d
/* Force backplane clocks to assure F2 interrupt propagates */
saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
&err);
@ -142,7 +142,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
if (err)
brcmf_err("Failed to force clock for F2: err %d\n",
err);
@@ -3339,20 +3362,45 @@ err:
@@ -3343,20 +3366,45 @@ err:
return bcmerror;
}
@ -190,7 +190,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
if (err) {
brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
@@ -3361,8 +3409,7 @@ static void brcmf_sdio_sr_init(struct br
@@ -3365,8 +3413,7 @@ static void brcmf_sdio_sr_init(struct br
/* Add CMD14 Support */
brcmf_sdiod_func0_wb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
@ -200,7 +200,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
&err);
if (err) {
brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
@@ -3370,7 +3417,7 @@ static void brcmf_sdio_sr_init(struct br
@@ -3374,7 +3421,7 @@ static void brcmf_sdio_sr_init(struct br
}
brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
@ -209,7 +209,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
if (err) {
brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
return;
@@ -4062,7 +4109,7 @@ static void brcmf_sdio_firmware_callback
@@ -4065,7 +4112,7 @@ static void brcmf_sdio_firmware_callback
const struct firmware *code;
void *nvram;
u32 nvram_len;
@ -218,7 +218,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
u8 devctl;
brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
@@ -4096,8 +4143,11 @@ static void brcmf_sdio_firmware_callback
@@ -4099,8 +4146,11 @@ static void brcmf_sdio_firmware_callback
/* Force clocks on backplane to be sure F2 interrupt propagates */
saveclk = brcmf_sdiod_readb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR, &err);
if (!err) {

View File

@ -29,7 +29,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
#ifdef DEBUG
@@ -4184,6 +4185,17 @@ static void brcmf_sdio_firmware_callback
@@ -4187,6 +4188,17 @@ static void brcmf_sdio_firmware_callback
CY_4373_F2_WATERMARK |
SBSDIO_MESBUSYCTRL_ENAB, &err);
break;

View File

@ -30,7 +30,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3365,7 +3365,11 @@ err:
@@ -3369,7 +3369,11 @@ err:
static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
{

View File

@ -14,7 +14,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -1557,6 +1557,10 @@ void brcmf_usb_exit(void)
@@ -1558,6 +1558,10 @@ void brcmf_usb_exit(void)
void brcmf_usb_register(void)
{

View File

@ -51,7 +51,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* @ifidx: interface index.
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -508,7 +508,7 @@ static void brcmf_usb_rx_complete(struct
@@ -509,7 +509,7 @@ static void brcmf_usb_rx_complete(struct
skb = req->skb;
req->skb = NULL;

View File

@ -1,101 +0,0 @@
From aaf6a5e86e36766abbeedf220462bde8031f9a72 Mon Sep 17 00:00:00 2001
From: Arend van Spriel <arend.vanspriel@broadcom.com>
Date: Thu, 14 Feb 2019 13:43:49 +0100
Subject: [PATCH] brcmfmac: create debugfs files for bus-specific layer
Since we moved the drivers debugfs directory under ieee80211 debugfs the
debugfs entries need to be added after wiphy_register() has been called.
For most part that has been done accordingly, but for the debugfs entries
added by SDIO it was not and failed silently. This patch fixes that by
adding a bus-layer callback for it.
Fixes: 856d5a011c86 ("brcmfmac: allocate struct brcmf_pub instance using wiphy_new()")
Reported-by: Russel King <linux@armlinux.org.uk>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
---
.../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 10 ++++++++++
.../net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 +
.../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 12 +++++++-----
3 files changed, 18 insertions(+), 5 deletions(-)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
@@ -90,6 +90,7 @@ struct brcmf_bus_ops {
int (*get_memdump)(struct device *dev, void *data, size_t len);
int (*get_fwname)(struct device *dev, const char *ext,
unsigned char *fw_name);
+ void (*debugfs_create)(struct device *dev);
};
@@ -235,6 +236,15 @@ int brcmf_bus_get_fwname(struct brcmf_bu
return bus->ops->get_fwname(bus->dev, ext, fw_name);
}
+static inline
+void brcmf_bus_debugfs_create(struct brcmf_bus *bus)
+{
+ if (!bus->ops->debugfs_create)
+ return;
+
+ return bus->ops->debugfs_create(bus->dev);
+}
+
/*
* interface functions from common layer
*/
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -1181,6 +1181,7 @@ static int brcmf_bus_started(struct brcm
brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
brcmf_feat_debugfs_create(drvr);
brcmf_proto_debugfs_create(drvr);
+ brcmf_bus_debugfs_create(bus_if);
return 0;
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3154,9 +3154,12 @@ static int brcmf_debugfs_sdio_count_read
return 0;
}
-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
+static void brcmf_sdio_debugfs_create(struct device *dev)
{
- struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
+ struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+ struct brcmf_pub *drvr = bus_if->drvr;
+ struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+ struct brcmf_sdio *bus = sdiodev->bus;
struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
if (IS_ERR_OR_NULL(dentry))
@@ -3176,7 +3179,7 @@ static int brcmf_sdio_checkdied(struct b
return 0;
}
-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
+static void brcmf_sdio_debugfs_create(struct device *dev)
{
}
#endif /* DEBUG */
@@ -3488,8 +3491,6 @@ static int brcmf_sdio_bus_preinit(struct
if (bus->rxbuf)
bus->rxblen = value;
- brcmf_sdio_debugfs_create(bus);
-
/* the commands below use the terms tx and rx from
* a device perspective, ie. bus:txglom affects the
* bus transfers from device to host.
@@ -4099,6 +4100,7 @@ static const struct brcmf_bus_ops brcmf_
.get_ramsize = brcmf_sdio_bus_get_ramsize,
.get_memdump = brcmf_sdio_bus_get_memdump,
.get_fwname = brcmf_sdio_get_fwname,
+ .debugfs_create = brcmf_sdio_debugfs_create
};
#define BRCMF_SDIO_FW_CODE 0

View File

@ -18,7 +18,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3010,21 +3010,35 @@ static int brcmf_sdio_trap_info(struct s
@@ -3011,21 +3011,35 @@ static int brcmf_sdio_trap_info(struct s
if (error < 0)
return error;
@ -69,7 +69,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
return 0;
}
@@ -3078,8 +3092,10 @@ static int brcmf_sdio_checkdied(struct b
@@ -3079,8 +3093,10 @@ static int brcmf_sdio_checkdied(struct b
else if (sh.flags & SDPCM_SHARED_ASSERT)
brcmf_err("assertion in dongle\n");
@ -81,7 +81,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
return 0;
}
@@ -4210,7 +4226,7 @@ static void brcmf_sdio_firmware_callback
@@ -4211,7 +4227,7 @@ static void brcmf_sdio_firmware_callback
} else {
/* Disable F2 again */
sdio_disable_func(sdiod->func2);
@ -90,7 +90,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
}
if (brcmf_chip_sr_capable(bus->ci)) {
@@ -4231,8 +4247,10 @@ static void brcmf_sdio_firmware_callback
@@ -4232,8 +4248,10 @@ static void brcmf_sdio_firmware_callback
}
/* If we didn't come up, turn off backplane clock */
@ -102,7 +102,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
sdio_release_host(sdiod->func1);
@@ -4246,12 +4264,15 @@ static void brcmf_sdio_firmware_callback
@@ -4247,12 +4265,15 @@ static void brcmf_sdio_firmware_callback
err = brcmf_attach(sdiod->dev, sdiod->settings);
if (err != 0) {
brcmf_err("brcmf_attach failed\n");

View File

@ -20,7 +20,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -575,7 +575,6 @@ static void
@@ -576,7 +576,6 @@ static void
brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
{
struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
@ -28,7 +28,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
devinfo->bus_pub.state, state);
@@ -583,7 +582,6 @@ brcmf_usb_state_change(struct brcmf_usbd
@@ -584,7 +583,6 @@ brcmf_usb_state_change(struct brcmf_usbd
if (devinfo->bus_pub.state == state)
return;

View File

@ -14,7 +14,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -445,9 +445,10 @@ fail:
@@ -446,9 +446,10 @@ fail:
}
@ -26,7 +26,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
int i = 0;
list_for_each_entry_safe(req, next, q, list) {
if (!req->urb) {
@@ -455,12 +456,8 @@ static void brcmf_usb_free_q(struct list
@@ -456,12 +457,8 @@ static void brcmf_usb_free_q(struct list
break;
}
i++;
@ -41,7 +41,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
}
}
@@ -1029,8 +1026,8 @@ static void brcmf_usb_detach(struct brcm
@@ -1030,8 +1027,8 @@ static void brcmf_usb_detach(struct brcm
brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
/* free the URBS */

View File

@ -13,7 +13,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -449,13 +449,11 @@ static void brcmf_usb_free_q(struct list
@@ -450,13 +450,11 @@ static void brcmf_usb_free_q(struct list
{
struct brcmf_usbreq *req, *next;

View File

@ -1,41 +0,0 @@
From a927e8d8ab57e696800e20cf09a72b7dfe3bbebb Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 9 Apr 2019 12:43:33 +0100
Subject: [PATCH] brcmfmac: fix leak of mypkt on error return path
Currently if the call to brcmf_sdiod_set_backplane_window fails then
error return path leaks mypkt. Fix this by returning by a new
error path labelled 'out' that calls brcmu_pkt_buf_free_skb to free
mypkt. Also remove redundant check on err before calling
brcmf_sdiod_skbuff_write.
Addresses-Coverity: ("Resource Leak")
Fixes: a7c3aa1509e2 ("brcmfmac: Remove brcmf_sdiod_addrprep()")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -617,15 +617,13 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
if (err)
- return err;
+ goto out;
addr &= SBSDIO_SB_OFT_ADDR_MASK;
addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
- if (!err)
- err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
- mypkt);
-
+ err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr, mypkt);
+out:
brcmu_pkt_buf_free_skb(mypkt);
return err;

View File

@ -153,7 +153,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
kfree(bus->msgbuf->flowrings);
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4251,17 +4251,26 @@ static void brcmf_sdio_firmware_callback
@@ -4252,17 +4252,26 @@ static void brcmf_sdio_firmware_callback
sdiod->bus_if->chip = bus->ci->chip;
sdiod->bus_if->chiprev = bus->ci->chiprev;
@ -185,7 +185,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
release:
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -1178,8 +1178,12 @@ static void brcmf_usb_probe_phase2(struc
@@ -1179,8 +1179,12 @@ static void brcmf_usb_probe_phase2(struc
if (ret)
goto error;
@ -199,7 +199,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
if (ret)
goto error;
@@ -1251,7 +1255,10 @@ static int brcmf_usb_probe_cb(struct brc
@@ -1252,7 +1256,10 @@ static int brcmf_usb_probe_cb(struct brc
}
if (!brcmf_usb_dlneeded(devinfo)) {
@ -211,7 +211,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
if (ret)
goto fail;
/* we are done */
@@ -1279,6 +1286,7 @@ static int brcmf_usb_probe_cb(struct brc
@@ -1280,6 +1287,7 @@ static int brcmf_usb_probe_cb(struct brc
fail:
/* Release resources in reverse order */
@ -219,7 +219,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
kfree(bus);
brcmf_usb_detach(devinfo);
return ret;
@@ -1292,6 +1300,7 @@ brcmf_usb_disconnect_cb(struct brcmf_usb
@@ -1293,6 +1301,7 @@ brcmf_usb_disconnect_cb(struct brcmf_usb
brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
brcmf_detach(devinfo->dev);
@ -227,7 +227,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
kfree(devinfo->bus_pub.bus);
brcmf_usb_detach(devinfo);
}
@@ -1435,10 +1444,12 @@ static int brcmf_usb_suspend(struct usb_
@@ -1436,10 +1445,12 @@ static int brcmf_usb_suspend(struct usb_
brcmf_dbg(USB, "Enter\n");
devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
@ -242,7 +242,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
return 0;
}
@@ -1451,8 +1462,19 @@ static int brcmf_usb_resume(struct usb_i
@@ -1452,8 +1463,19 @@ static int brcmf_usb_resume(struct usb_i
struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
brcmf_dbg(USB, "Enter\n");

View File

@ -1,31 +0,0 @@
From 216b44000ada87a63891a8214c347e05a4aea8fe Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 3 Dec 2019 12:58:55 +0300
Subject: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes()
The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
static checker warning:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
error: dereferencing freed memory 'pkt'
It looks like there was supposed to be a continue after we free "pkt".
Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct
BRCMF_SDIO_FT_NORMAL)) {
rd->len = 0;
brcmu_pkt_buf_free_skb(pkt);
+ continue;
}
bus->sdcnt.rx_readahead_cnt++;
if (rd->len != roundup(rd_new.len, 16)) {

View File

@ -1,40 +0,0 @@
From 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 10 Dec 2019 12:44:22 +0100
Subject: [PATCH] brcmfmac: fix interface sanity check
Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.
Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.
Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
Cc: stable <stable@vger.kernel.org> # 3.4
Cc: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -1348,7 +1348,7 @@ brcmf_usb_probe(struct usb_interface *in
goto fail;
}
- desc = &intf->altsetting[0].desc;
+ desc = &intf->cur_altsetting->desc;
if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) ||
(desc->bInterfaceSubClass != 2) ||
(desc->bInterfaceProtocol != 0xff)) {
@@ -1361,7 +1361,7 @@ brcmf_usb_probe(struct usb_interface *in
num_of_eps = desc->bNumEndpoints;
for (ep = 0; ep < num_of_eps; ep++) {
- endpoint = &intf->altsetting[0].endpoint[ep].desc;
+ endpoint = &intf->cur_altsetting->endpoint[ep].desc;
endpoint_num = usb_endpoint_num(endpoint);
if (!usb_endpoint_xfer_bulk(endpoint))
continue;

View File

@ -1,26 +0,0 @@
From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sat, 14 Dec 2019 19:51:14 -0600
Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_usbdev_qinit
In the implementation of brcmf_usbdev_qinit() the allocated memory for
reqs is leaking if usb_alloc_urb() fails. Release reqs in the error
handling path.
Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -430,6 +430,7 @@ fail:
usb_free_urb(req->urb);
list_del(q->next);
}
+ kfree(reqs);
return NULL;
}

View File

@ -1,6 +1,6 @@
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -11498,6 +11498,15 @@ static const struct attribute_group ipw_
@@ -11499,6 +11499,15 @@ static const struct attribute_group ipw_
.attrs = ipw_sysfs_entries,
};
@ -16,7 +16,7 @@
#ifdef CPTCFG_IPW2200_PROMISCUOUS
static int ipw_prom_open(struct net_device *dev)
{
@@ -11546,15 +11555,6 @@ static netdev_tx_t ipw_prom_hard_start_x
@@ -11547,15 +11556,6 @@ static netdev_tx_t ipw_prom_hard_start_x
return NETDEV_TX_OK;
}

View File

@ -140,7 +140,7 @@
# LED support
--- a/drivers/net/wireless/broadcom/b43legacy/main.c
+++ b/drivers/net/wireless/broadcom/b43legacy/main.c
@@ -1937,7 +1937,7 @@ static int b43legacy_gpio_init(struct b4
@@ -1938,7 +1938,7 @@ static int b43legacy_gpio_init(struct b4
if (dev->dev->id.revision >= 2)
mask |= 0x0010; /* FIXME: This is redundant. */
@ -149,7 +149,7 @@
pcidev = bus->pcicore.dev;
#endif
gpiodev = bus->chipco.dev ? : pcidev;
@@ -1956,7 +1956,7 @@ static void b43legacy_gpio_cleanup(struc
@@ -1957,7 +1957,7 @@ static void b43legacy_gpio_cleanup(struc
struct ssb_bus *bus = dev->dev->bus;
struct ssb_device *gpiodev, *pcidev = NULL;

View File

@ -1,6 +1,6 @@
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
@@ -2041,6 +2041,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
@@ -2053,6 +2053,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
goto err_wiphy_new;
}

View File

@ -1,6 +1,6 @@
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
@@ -2117,6 +2117,8 @@ int lbs_cfg_register(struct lbs_private
@@ -2129,6 +2129,8 @@ int lbs_cfg_register(struct lbs_private
wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
wdev->wiphy->reg_notifier = lbs_reg_notifier;

View File

@ -25,7 +25,7 @@ Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -6627,6 +6627,11 @@ bool cfg80211_iftype_allowed(struct wiph
@@ -6632,6 +6632,11 @@ bool cfg80211_iftype_allowed(struct wiph
#define wiphy_info(wiphy, format, args...) \
dev_info(&(wiphy)->dev, format, ##args)

View File

@ -1,6 +1,6 @@
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3800,6 +3800,12 @@ out:
@@ -3822,6 +3822,12 @@ out:
netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
struct net_device *dev)
{

View File

@ -77,7 +77,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
atomic_t agg_queue_stop[IEEE80211_MAX_QUEUES];
@@ -2046,6 +2048,7 @@ void ieee80211_txq_remove_vlan(struct ie
@@ -2047,6 +2049,7 @@ void ieee80211_txq_remove_vlan(struct ie
struct ieee80211_sub_if_data *sdata);
void ieee80211_fill_txq_stats(struct cfg80211_txq_stats *txqstats,
struct txq_info *txqi);
@ -100,7 +100,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(unsigned long) local);
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3485,13 +3485,19 @@ struct sk_buff *ieee80211_tx_dequeue(str
@@ -3487,13 +3487,19 @@ struct sk_buff *ieee80211_tx_dequeue(str
struct ieee80211_tx_info *info;
struct ieee80211_tx_data tx;
ieee80211_tx_result r;
@ -122,7 +122,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
/* Make sure fragments stay together. */
skb = __skb_dequeue(&txqi->frags);
if (skb)
@@ -3586,6 +3592,7 @@ begin:
@@ -3606,6 +3612,7 @@ begin:
}
IEEE80211_SKB_CB(skb)->control.vif = vif;

View File

@ -12,7 +12,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -881,6 +881,7 @@ static void __ieee80211_tx_status(struct
@@ -719,6 +719,7 @@ static void __ieee80211_tx_status(struct
int rates_idx;
bool send_to_cooked;
bool acked;
@ -20,7 +20,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
struct ieee80211_bar *bar;
int shift = 0;
int tid = IEEE80211_NUM_TIDS;
@@ -898,6 +899,8 @@ static void __ieee80211_tx_status(struct
@@ -736,6 +737,8 @@ static void __ieee80211_tx_status(struct
clear_sta_flag(sta, WLAN_STA_SP);
acked = !!(info->flags & IEEE80211_TX_STAT_ACK);
@ -29,7 +29,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
/* mesh Peer Service Period support */
if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
@@ -962,12 +965,12 @@ static void __ieee80211_tx_status(struct
@@ -800,12 +803,12 @@ static void __ieee80211_tx_status(struct
ieee80211_handle_filtered_frame(local, sta, skb);
return;
} else {
@ -44,8 +44,8 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
sta->status_stats.msdu_failed[tid]++;
sta->status_stats.msdu_retries[tid] +=
@@ -994,7 +997,7 @@ static void __ieee80211_tx_status(struct
info->status.tx_time, 0);
@@ -826,7 +829,7 @@ static void __ieee80211_tx_status(struct
acked, info->status.tx_time);
if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
- if (info->flags & IEEE80211_TX_STAT_ACK) {
@ -53,7 +53,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
if (sta->status_stats.lost_packets)
sta->status_stats.lost_packets = 0;
@@ -1002,6 +1005,8 @@ static void __ieee80211_tx_status(struct
@@ -834,6 +837,8 @@ static void __ieee80211_tx_status(struct
if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
sta->status_stats.last_tdls_pkt_time =
jiffies;
@ -62,7 +62,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
} else {
ieee80211_lost_packet(sta, info);
}
@@ -1127,7 +1132,7 @@ void ieee80211_tx_status_ext(struct ieee
@@ -959,7 +964,7 @@ void ieee80211_tx_status_ext(struct ieee
sta = container_of(pubsta, struct sta_info, sta);
@ -71,7 +71,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
sta->status_stats.retry_failed++;
sta->status_stats.retry_count += retry_count;
@@ -1142,6 +1147,8 @@ void ieee80211_tx_status_ext(struct ieee
@@ -974,6 +979,8 @@ void ieee80211_tx_status_ext(struct ieee
sta->status_stats.last_tdls_pkt_time = jiffies;
} else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
return;

View File

@ -1,22 +0,0 @@
From: Felix Fietkau <nbd@nbd.name>
Date: Fri, 14 Jun 2019 21:12:04 +0200
Subject: [PATCH] mac80211: minstrel_ht: fix per-group max throughput rate
initialization
The group number needs to be multiplied by the number of rates per group
to get the full rate index
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -542,7 +542,7 @@ minstrel_ht_update_stats(struct minstrel
/* (re)Initialize group rate indexes */
for(j = 0; j < MAX_THR_RATES; j++)
- tmp_group_tp_rate[j] = group;
+ tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
for (i = 0; i < MCS_GROUP_RATES; i++) {
if (!(mi->supported[group] & BIT(i)))

View File

@ -191,7 +191,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1244,7 +1244,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
@@ -1249,7 +1249,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
if (!txq_has_queue(sta->sta.txq[i]))
continue;
@ -229,7 +229,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
return true;
}
@@ -3600,6 +3604,60 @@ out:
@@ -3620,6 +3624,60 @@ out:
}
EXPORT_SYMBOL(ieee80211_tx_dequeue);
@ -289,4 +289,4 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+
void __ieee80211_subif_start_xmit(struct sk_buff *skb,
struct net_device *dev,
u32 info_flags)
u32 info_flags,

View File

@ -148,7 +148,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
MAX_NL80211_EXT_FEATURES = NUM_NL80211_EXT_FEATURES - 1
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -463,6 +463,7 @@ static const struct nla_policy nl80211_p
@@ -469,6 +469,7 @@ static const struct nla_policy nl80211_p
[NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
[NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
.len = NL80211_HE_MAX_CAPABILITY_LEN },
@ -156,7 +156,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
};
/* policy for the key attributes */
@@ -4703,6 +4704,11 @@ static int nl80211_send_station(struct s
@@ -4709,6 +4710,11 @@ static int nl80211_send_station(struct s
PUT_SINFO(PLID, plid, u16);
PUT_SINFO(PLINK_STATE, plink_state, u8);
PUT_SINFO_U64(RX_DURATION, rx_duration);
@ -168,7 +168,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
switch (rdev->wiphy.signal_type) {
case CFG80211_SIGNAL_TYPE_MBM:
@@ -5339,6 +5345,15 @@ static int nl80211_set_station(struct sk
@@ -5345,6 +5351,15 @@ static int nl80211_set_station(struct sk
nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
}
@ -184,7 +184,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
/* Include parameters for TDLS peer (will check later) */
err = nl80211_set_station_tdls(info, &params);
if (err)
@@ -5477,6 +5492,15 @@ static int nl80211_new_station(struct sk
@@ -5483,6 +5498,15 @@ static int nl80211_new_station(struct sk
return -EINVAL;
}

View File

@ -302,7 +302,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
}
for (i = 0; i < IEEE80211_NUM_TIDS; i++)
@@ -1821,6 +1821,27 @@ void ieee80211_sta_set_buffered(struct i
@@ -1826,6 +1826,27 @@ void ieee80211_sta_set_buffered(struct i
}
EXPORT_SYMBOL(ieee80211_sta_set_buffered);
@ -330,7 +330,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
int sta_info_move_state(struct sta_info *sta,
enum ieee80211_sta_state new_state)
{
@@ -2187,6 +2208,23 @@ void sta_set_sinfo(struct sta_info *sta,
@@ -2192,6 +2213,23 @@ void sta_set_sinfo(struct sta_info *sta,
sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
}
@ -385,7 +385,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
*/
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -825,6 +825,12 @@ static void __ieee80211_tx_status(struct
@@ -828,6 +828,12 @@ static void __ieee80211_tx_status(struct
ieee80211_sta_tx_notify(sta->sdata, (void *) skb->data,
acked, info->status.tx_time);
@ -396,7 +396,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+ info->status.tx_time, 0);
+
if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
if (info->flags & IEEE80211_TX_STAT_ACK) {
if (acked) {
if (sta->status_stats.lost_packets)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@ -412,7 +412,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
list_del_init(&txqi->schedule_order);
spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
@@ -3611,11 +3614,28 @@ struct ieee80211_txq *ieee80211_next_txq
@@ -3631,11 +3634,28 @@ struct ieee80211_txq *ieee80211_next_txq
lockdep_assert_held(&local->active_txq_lock[ac]);
@ -442,7 +442,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
return NULL;
list_del_init(&txqi->schedule_order);
@@ -3633,12 +3653,74 @@ void ieee80211_return_txq(struct ieee802
@@ -3653,12 +3673,74 @@ void ieee80211_return_txq(struct ieee802
lockdep_assert_held(&local->active_txq_lock[txq->ac]);
if (list_empty(&txqi->schedule_order) &&

View File

@ -51,7 +51,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3673,6 +3673,19 @@ void ieee80211_return_txq(struct ieee802
@@ -3693,6 +3693,19 @@ void ieee80211_return_txq(struct ieee802
}
EXPORT_SYMBOL(ieee80211_return_txq);

View File

@ -48,15 +48,15 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (likely(sta)) {
if (!IS_ERR(sta))
tx->sta = sta;
@@ -3523,6 +3523,7 @@ begin:
@@ -3525,6 +3525,7 @@ begin:
tx.local = local;
tx.skb = skb;
tx.sdata = vif_to_sdata(info->control.vif);
+ tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
if (txq->sta)
if (txq->sta) {
tx.sta = container_of(txq->sta, struct sta_info, sta);
@@ -3549,7 +3550,7 @@ begin:
@@ -3569,7 +3570,7 @@ begin:
if (tx.key &&
(tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
@ -65,7 +65,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
tx.key, skb);
@@ -4006,6 +4007,7 @@ ieee80211_build_data_template(struct iee
@@ -4028,6 +4029,7 @@ ieee80211_build_data_template(struct iee
hdr = (void *)skb->data;
tx.sta = sta_info_get(sdata, hdr->addr1);
tx.skb = skb;
@ -75,7 +75,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
rcu_read_unlock();
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1390,6 +1390,7 @@ void ieee80211_send_auth(struct ieee8021
@@ -1396,6 +1396,7 @@ void ieee80211_send_auth(struct ieee8021
struct ieee80211_local *local = sdata->local;
struct sk_buff *skb;
struct ieee80211_mgmt *mgmt;
@ -83,7 +83,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
int err;
/* 24 + 6 = header + auth_algo + auth_transaction + status_code */
@@ -1413,8 +1414,10 @@ void ieee80211_send_auth(struct ieee8021
@@ -1419,8 +1420,10 @@ void ieee80211_send_auth(struct ieee8021
skb_put_data(skb, extra, extra_len);
if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {

View File

@ -236,7 +236,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (skb->len < len_rthdr + hdrlen)
goto fail;
@@ -2440,7 +2439,7 @@ static struct sk_buff *ieee80211_build_h
@@ -2441,7 +2440,7 @@ static struct sk_buff *ieee80211_build_h
struct ieee80211_chanctx_conf *chanctx_conf;
struct ieee80211_sub_if_data *ap_sdata;
enum nl80211_band band;
@ -245,7 +245,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (IS_ERR(sta))
sta = NULL;
@@ -2739,7 +2738,9 @@ static struct sk_buff *ieee80211_build_h
@@ -2740,7 +2739,9 @@ static struct sk_buff *ieee80211_build_h
}
skb_pull(skb, skip_header_bytes);
@ -255,7 +255,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
/*
* So we need to modify the skb header and hence need a copy of
@@ -2772,6 +2773,9 @@ static struct sk_buff *ieee80211_build_h
@@ -2773,6 +2774,9 @@ static struct sk_buff *ieee80211_build_h
memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
#endif
@ -265,7 +265,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (ieee80211_is_data_qos(fc)) {
__le16 *qos_control;
@@ -2947,6 +2951,8 @@ void ieee80211_check_fast_xmit(struct st
@@ -2949,6 +2953,8 @@ void ieee80211_check_fast_xmit(struct st
fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
}
@ -274,16 +274,16 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
/* We store the key here so there's no point in using rcu_dereference()
* but that's fine because the code that changes the pointers will call
* this function after doing so. For a single CPU that would be enough,
@@ -3523,7 +3529,7 @@ begin:
@@ -3525,7 +3531,7 @@ begin:
tx.local = local;
tx.skb = skb;
tx.sdata = vif_to_sdata(info->control.vif);
- tx.hdrlen = ieee80211_hdrlen(hdr->frame_control);
+ tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr->frame_control);
if (txq->sta)
if (txq->sta) {
tx.sta = container_of(txq->sta, struct sta_info, sta);
@@ -4007,7 +4013,7 @@ ieee80211_build_data_template(struct iee
@@ -4029,7 +4035,7 @@ ieee80211_build_data_template(struct iee
hdr = (void *)skb->data;
tx.sta = sta_info_get(sdata, hdr->addr1);
tx.skb = skb;

View File

@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
* ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3617,16 +3617,17 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
@@ -3637,16 +3637,17 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
{
struct ieee80211_local *local = hw_to_local(hw);
@ -115,7 +115,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (txqi->txq.sta) {
struct sta_info *sta = container_of(txqi->txq.sta,
@@ -3643,21 +3644,25 @@ struct ieee80211_txq *ieee80211_next_txq
@@ -3663,21 +3664,25 @@ struct ieee80211_txq *ieee80211_next_txq
if (txqi->schedule_round == local->schedule_round[ac])
@ -146,7 +146,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (list_empty(&txqi->schedule_order) &&
(!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets)) {
@@ -3677,18 +3682,7 @@ void ieee80211_return_txq(struct ieee802
@@ -3697,18 +3702,7 @@ void ieee80211_return_txq(struct ieee802
list_add_tail(&txqi->schedule_order,
&local->active_txqs[txq->ac]);
}
@ -165,7 +165,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
spin_unlock_bh(&local->active_txq_lock[txq->ac]);
}
EXPORT_SYMBOL(ieee80211_schedule_txq);
@@ -3701,7 +3695,7 @@ bool ieee80211_txq_may_transmit(struct i
@@ -3721,7 +3715,7 @@ bool ieee80211_txq_may_transmit(struct i
struct sta_info *sta;
u8 ac = txq->ac;
@ -174,7 +174,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (!txqi->txq.sta)
goto out;
@@ -3731,34 +3725,27 @@ bool ieee80211_txq_may_transmit(struct i
@@ -3751,34 +3745,27 @@ bool ieee80211_txq_may_transmit(struct i
sta->airtime[ac].deficit += sta->airtime_weight;
list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);

View File

@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -1112,16 +1112,13 @@ int mesh_nexthop_resolve(struct ieee8021
@@ -1115,16 +1115,13 @@ int mesh_nexthop_resolve(struct ieee8021
struct mesh_path *mpath;
struct sk_buff *skb_to_free = NULL;
u8 *target_addr = hdr->addr3;
@ -28,7 +28,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
/* no nexthop found, start resolving */
mpath = mesh_path_lookup(sdata, target_addr);
@@ -1129,8 +1126,7 @@ int mesh_nexthop_resolve(struct ieee8021
@@ -1132,8 +1129,7 @@ int mesh_nexthop_resolve(struct ieee8021
mpath = mesh_path_add(sdata, target_addr);
if (IS_ERR(mpath)) {
mesh_path_discard_frame(sdata, skb);
@ -38,7 +38,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
}
}
@@ -1143,13 +1139,10 @@ int mesh_nexthop_resolve(struct ieee8021
@@ -1147,13 +1143,10 @@ int mesh_nexthop_resolve(struct ieee8021
info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
ieee80211_set_qos_hdr(sdata, skb);
skb_queue_tail(&mpath->frame_queue, skb);
@ -53,7 +53,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
}
/**
@@ -1169,13 +1162,10 @@ int mesh_nexthop_lookup(struct ieee80211
@@ -1173,13 +1166,10 @@ int mesh_nexthop_lookup(struct ieee80211
struct sta_info *next_hop;
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
u8 *target_addr = hdr->addr3;
@ -68,7 +68,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (time_after(jiffies,
mpath->exp_time -
@@ -1190,12 +1180,10 @@ int mesh_nexthop_lookup(struct ieee80211
@@ -1194,12 +1184,10 @@ int mesh_nexthop_lookup(struct ieee80211
memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
ieee80211_mps_set_frame_flags(sdata, next_hop, hdr);

View File

@ -111,7 +111,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
schedule_and_wake_txq(local, txqi);
@@ -3198,6 +3199,7 @@ static bool ieee80211_amsdu_aggregate(st
@@ -3200,6 +3201,7 @@ static bool ieee80211_amsdu_aggregate(st
u8 max_subframes = sta->sta.max_amsdu_subframes;
int max_frags = local->hw.max_tx_fragments;
int max_amsdu_len = sta->sta.max_amsdu_len;
@ -119,7 +119,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
int orig_truesize;
__be16 len;
void *data;
@@ -3220,6 +3222,8 @@ static bool ieee80211_amsdu_aggregate(st
@@ -3222,6 +3224,8 @@ static bool ieee80211_amsdu_aggregate(st
max_amsdu_len = min_t(int, max_amsdu_len,
sta->sta.max_rc_amsdu_len);
@ -128,7 +128,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
spin_lock_bh(&fq->lock);
/* TODO: Ideally aggregation should be done on dequeue to remain
@@ -3227,7 +3231,8 @@ static bool ieee80211_amsdu_aggregate(st
@@ -3229,7 +3233,8 @@ static bool ieee80211_amsdu_aggregate(st
*/
tin = &txqi->tin;

View File

@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3505,6 +3505,7 @@ struct sk_buff *ieee80211_tx_dequeue(str
@@ -3507,6 +3507,7 @@ struct sk_buff *ieee80211_tx_dequeue(str
ieee80211_tx_result r;
struct ieee80211_vif *vif = txq->vif;
@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
spin_lock_bh(&fq->lock);
if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ||
@@ -3521,11 +3522,12 @@ struct sk_buff *ieee80211_tx_dequeue(str
@@ -3523,11 +3524,12 @@ struct sk_buff *ieee80211_tx_dequeue(str
if (skb)
goto out;
@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
hdr = (struct ieee80211_hdr *)skb->data;
info = IEEE80211_SKB_CB(skb);
@@ -3571,8 +3573,11 @@ begin:
@@ -3591,8 +3593,11 @@ begin:
skb = __skb_dequeue(&tx.skbs);
@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
}
if (skb && skb_has_frag_list(skb) &&
@@ -3611,6 +3616,7 @@ begin:
@@ -3631,6 +3636,7 @@ begin:
}
IEEE80211_SKB_CB(skb)->control.vif = vif;

View File

@ -24,7 +24,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1761,6 +1761,9 @@ void ieee80211_clear_fast_xmit(struct st
@@ -1762,6 +1762,9 @@ void ieee80211_clear_fast_xmit(struct st
int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
const u8 *buf, size_t len,
const u8 *dest, __be16 proto, bool unencrypted);
@ -143,7 +143,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
ieee80211_free_txskb(&local->hw, skb);
return;
}
@@ -2740,30 +2746,14 @@ static struct sk_buff *ieee80211_build_h
@@ -2741,30 +2747,14 @@ static struct sk_buff *ieee80211_build_h
skb_pull(skb, skip_header_bytes);
padsize = ieee80211_hdr_padsize(&local->hw, hdrlen);
@ -180,7 +180,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
}
if (encaps_data)
@@ -3375,7 +3365,6 @@ static bool ieee80211_xmit_fast(struct i
@@ -3377,7 +3367,6 @@ static bool ieee80211_xmit_fast(struct i
struct ieee80211_local *local = sdata->local;
u16 ethertype = (skb->data[12] << 8) | skb->data[13];
int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
@ -188,7 +188,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
struct ethhdr eth;
struct ieee80211_tx_info *info;
struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
@@ -3427,10 +3416,7 @@ static bool ieee80211_xmit_fast(struct i
@@ -3429,10 +3418,7 @@ static bool ieee80211_xmit_fast(struct i
* as the may-encrypt argument for the resize to not account for
* more room than we already have in 'extra_head'
*/

View File

@ -72,7 +72,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
/**
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3653,8 +3653,9 @@ out:
@@ -3673,8 +3673,9 @@ out:
}
EXPORT_SYMBOL(ieee80211_next_txq);
@ -84,7 +84,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
{
struct ieee80211_local *local = hw_to_local(hw);
struct txq_info *txqi = to_txq_info(txq);
@@ -3662,7 +3663,8 @@ void ieee80211_schedule_txq(struct ieee8
@@ -3682,7 +3683,8 @@ void ieee80211_schedule_txq(struct ieee8
spin_lock_bh(&local->active_txq_lock[txq->ac]);
if (list_empty(&txqi->schedule_order) &&
@ -94,7 +94,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
/* If airtime accounting is active, always enqueue STAs at the
* head of the list to ensure that they only get moved to the
* back by the airtime DRR scheduler once they have a negative
@@ -3682,7 +3684,7 @@ void ieee80211_schedule_txq(struct ieee8
@@ -3702,7 +3704,7 @@ void ieee80211_schedule_txq(struct ieee8
spin_unlock_bh(&local->active_txq_lock[txq->ac]);
}

View File

@ -13,15 +13,15 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3751,6 +3751,7 @@ void __ieee80211_subif_start_xmit(struct
u32 info_flags)
@@ -3772,6 +3772,7 @@ void __ieee80211_subif_start_xmit(struct
u32 ctrl_flags)
{
struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ struct ieee80211_local *local = sdata->local;
struct sta_info *sta;
struct sk_buff *next;
@@ -3764,7 +3765,15 @@ void __ieee80211_subif_start_xmit(struct
@@ -3785,7 +3786,15 @@ void __ieee80211_subif_start_xmit(struct
if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
goto out_free;

View File

@ -54,7 +54,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
}
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2070,7 +2070,8 @@ void ieee80211_send_auth(struct ieee8021
@@ -2071,7 +2071,8 @@ void ieee80211_send_auth(struct ieee8021
const u8 *da, const u8 *key, u8 key_len, u8 key_idx,
u32 tx_flags);
void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
@ -107,7 +107,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
frame_buf);
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1427,7 +1427,8 @@ void ieee80211_send_auth(struct ieee8021
@@ -1433,7 +1433,8 @@ void ieee80211_send_auth(struct ieee8021
}
void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
@ -117,7 +117,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
bool send_frame, u8 *frame_buf)
{
struct ieee80211_local *local = sdata->local;
@@ -1438,7 +1439,7 @@ void ieee80211_send_deauth_disassoc(stru
@@ -1444,7 +1445,7 @@ void ieee80211_send_deauth_disassoc(stru
mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
mgmt->duration = 0; /* initialize only */
mgmt->seq_ctrl = 0; /* initialize only */

View File

@ -1,39 +0,0 @@
From 95697f9907bfe3eab0ef20265a766b22e27dde64 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 4 Oct 2019 15:37:05 +0300
Subject: [PATCH] mac80211: accept deauth frames in IBSS mode
We can process deauth frames and all, but we drop them very
early in the RX path today - this could never have worked.
Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
net/mac80211/rx.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3407,9 +3407,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
/* process for all: mesh, mlme, ibss */
break;
+ case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+ if (is_multicast_ether_addr(mgmt->da) &&
+ !is_broadcast_ether_addr(mgmt->da))
+ return RX_DROP_MONITOR;
+
+ /* process only for station/IBSS */
+ if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+ sdata->vif.type != NL80211_IFTYPE_ADHOC)
+ return RX_DROP_MONITOR;
+ break;
case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
- case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
if (is_multicast_ether_addr(mgmt->da) &&
!is_broadcast_ether_addr(mgmt->da))

View File

@ -64,7 +64,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
__NL80211_SURVEY_INFO_AFTER_LAST,
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -8367,6 +8367,10 @@ static int nl80211_send_survey(struct sk
@@ -8373,6 +8373,10 @@ static int nl80211_send_survey(struct sk
nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
survey->time_scan, NL80211_SURVEY_INFO_PAD))
goto nla_put_failure;

View File

@ -8,7 +8,7 @@
*
* @set_wds_peer: set the WDS peer for a WDS interface
*
@@ -3272,6 +3273,7 @@ struct cfg80211_ops {
@@ -3275,6 +3276,7 @@ struct cfg80211_ops {
enum nl80211_tx_power_setting type, int mbm);
int (*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
int *dbm);
@ -77,7 +77,7 @@
static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
const u8 *addr)
{
@@ -3823,6 +3836,7 @@ const struct cfg80211_ops mac80211_confi
@@ -3845,6 +3858,7 @@ const struct cfg80211_ops mac80211_confi
.set_wiphy_params = ieee80211_set_wiphy_params,
.set_tx_power = ieee80211_set_tx_power,
.get_tx_power = ieee80211_get_tx_power,
@ -129,7 +129,7 @@
local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -464,6 +464,7 @@ static const struct nla_policy nl80211_p
@@ -470,6 +470,7 @@ static const struct nla_policy nl80211_p
[NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
.len = NL80211_HE_MAX_CAPABILITY_LEN },
[NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
@ -137,7 +137,7 @@
};
/* policy for the key attributes */
@@ -2623,6 +2624,20 @@ static int nl80211_set_wiphy(struct sk_b
@@ -2629,6 +2630,20 @@ static int nl80211_set_wiphy(struct sk_b
if (result)
return result;
}