summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless
AgeCommit message (Collapse)Author
2020-01-06wil6210: get rid of begin() and complete() ethtool_opsMichal Kubecek
The wil6210 driver locks a mutex in begin() ethtool_ops callback and unlocks it in complete() so that all ethtool requests are serialized. This is not going to work correctly with netlink interface; e.g. when ioctl triggers a netlink notification, netlink code would call begin() again while the mutex taken by ioctl code is still held by the same task. Let's get rid of the begin() and complete() callbacks and move the mutex locking into the remaining ethtool_ops handlers except get_drvinfo which only copies strings that are not changing so that there is no need for serialization. Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netDavid S. Miller
Mere overlapping changes in the conflicts here. Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netLinus Torvalds
Pull networking fixes from David Miller: 1) Several nf_flow_table_offload fixes from Pablo Neira Ayuso, including adding a missing ipv6 match description. 2) Several heap overflow fixes in mwifiex from qize wang and Ganapathi Bhat. 3) Fix uninit value in bond_neigh_init(), from Eric Dumazet. 4) Fix non-ACPI probing of nxp-nci, from Stephan Gerhold. 5) Fix use after free in tipc_disc_rcv(), from Tuong Lien. 6) Enforce limit of 33 tail calls in mips and riscv JIT, from Paul Chaignon. 7) Multicast MAC limit test is off by one in qede, from Manish Chopra. 8) Fix established socket lookup race when socket goes from TCP_ESTABLISHED to TCP_LISTEN, because there lacks an intervening RCU grace period. From Eric Dumazet. 9) Don't send empty SKBs from tcp_write_xmit(), also from Eric Dumazet. 10) Fix active backup transition after link failure in bonding, from Mahesh Bandewar. 11) Avoid zero sized hash table in gtp driver, from Taehee Yoo. 12) Fix wrong interface passed to ->mac_link_up(), from Russell King. 13) Fix DSA egress flooding settings in b53, from Florian Fainelli. 14) Memory leak in gmac_setup_txqs(), from Navid Emamdoost. 15) Fix double free in dpaa2-ptp code, from Ioana Ciornei. 16) Reject invalid MTU values in stmmac, from Jose Abreu. 17) Fix refcount leak in error path of u32 classifier, from Davide Caratti. 18) Fix regression causing iwlwifi firmware crashes on boot, from Anders Kaseorg. 19) Fix inverted return value logic in llc2 code, from Chan Shu Tak. 20) Disable hardware GRO when XDP is attached to qede, frm Manish Chopra. 21) Since we encode state in the low pointer bits, dst metrics must be at least 4 byte aligned, which is not necessarily true on m68k. Add annotations to fix this, from Geert Uytterhoeven. * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (160 commits) sfc: Include XDP packet headroom in buffer step size. sfc: fix channel allocation with brute force net: dst: Force 4-byte alignment of dst_metrics selftests: pmtu: fix init mtu value in description hv_netvsc: Fix unwanted rx_table reset net: phy: ensure that phy IDs are correctly typed mod_devicetable: fix PHY module format qede: Disable hardware gro when xdp prog is installed net: ena: fix issues in setting interrupt moderation params in ethtool net: ena: fix default tx interrupt moderation interval net/smc: unregister ib devices in reboot_event net: stmmac: platform: Fix MDIO init for platforms without PHY llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) net: hisilicon: Fix a BUG trigered by wrong bytes_compl net: dsa: ksz: use common define for tag len s390/qeth: don't return -ENOTSUPP to userspace s390/qeth: fix promiscuous mode after reset s390/qeth: handle error due to unsupported transport mode cxgb4: fix refcount init for TC-MQPRIO offload tc-testing: initial tdc selftests for cls_u32 ...
2019-12-20Merge tag 'wireless-drivers-next-2019-12-20' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for v5.6 First set of patches for v5.6. The biggest thing here is of course the new driver ath11k but also new features for other drivers as well a myriad of bug fixes. Major changes: ath11k * a new driver for Qualcomm Wi-Fi 6 (IEEE 802.11ax) devices ath10k * significant improvements on receive throughput and firmware download with SDIO bus * report signal strength for each chain also on SDIO * set max mtu to 1500 on SDIO devices brcmfmac * add support for BCM4359 SDIO chipset wil6210 * support set_multicast_to_unicast cfg80211 operation * support set_cqm_rssi_config cfg80211 operation wcn36xx * disable HW_CONNECTION_MONITOR as firmware is buggy ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-19Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo
ath.git patches for v5.6. Major changes: wil6210 * support set_multicast_to_unicast cfg80211 operation * support set_cqm_rssi_config cfg80211 operation wcn36xx * disable HW_CONNECTION_MONITOR as firmware is buggy
2019-12-19ath11k: Use sizeof_field() instead of FIELD_SIZEOF()Kees Cook
The FIELD_SIZEOF() macro was redundant, and is being removed from the kernel. Since commit c593642c8be0 ("treewide: Use sizeof_field() macro") this is one of the last users of the old macro, so replace it. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19ath11k: explicitly cast wmi commands to their correct struct typeJohn Crispin
Three of the WMI command handlers were not casting to the right data type. Lets make the code consistent with the other handlers. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19wil6210: add support for set_cqm_rssi_configDedy Lansky
set_cqm_rssi_config() is used by the kernel to configure connection quality monitor RSSI threshold. wil6210 uses WMI_SET_LINK_MONITOR_CMDID to set the RSSI threshold to FW which in turn reports RSSI threshold changes with WMI_LINK_MONITOR_EVENTID. Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19wil6210: support set_multicast_to_unicast cfg80211 operationAhmad Masri
Wil6210 AP has a separate ring for transmitting multicast packets, multicast packets are transmitted without an ack from the receiver side. Therefore, 802.11 spec defines some low MCS rates for multicat packets. However, there is no guarantee that these packets were really received and handled on the client side. Some applications that rely on multicast packets, may prefer to transmit these packets as a unicast to ensure reliability, and also to ensure better performance with high MCS rates. multicast to unicast is done by duplicating multicast packets to all clients and changing the DA (multicast) to the MAC address of the client. see NL80211_CMD_SET_MULTICAST_TO_UNICAST for more info. Signed-off-by: Ahmad Masri <amasri@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19wil6210: fix MID valid bits in Rx status messageDedy Lansky
Fix incorrect definitions of MAC ID bits inside Rx status message. Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19wil6210: reduce ucode_debug memory regionDedy Lansky
ucode_debug memory region defined as 4K bytes. Fix this according to Talyn device memory map. Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19wil6210: add verification for cid upper boundAlexei Avshalom Lazar
max_assoc_sta can receive values (from the user or from the FW) that are higher than WIL6210_MAX_CID. Verify that cid doesn't exceed the upper bound of WIL6210_MAX_CID. Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19wil6210: take mem_lock for writing in crash dump collectionAlexei Avshalom Lazar
On some crash dump cases mem_lock is already taken, error returns and crash dump copy fails. In this case wait until mem_lock available instead of failing the operation. Also take the mem_lock for writing to prevent other threads from altering the state of the device while collecting crash dump. Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19wil6210: minimize the time that mem_lock is heldAlexei Avshalom Lazar
mem_lock is taken for the entire wil_reset(). Optimize this by taking mem_lock just before device is being reset and release the lock after FW download. Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-19wil6210: dump Rx status message on errorsAhmad Masri
Dump all the Rx status message on different errors to allow more visibility of the case. Signed-off-by: Ahmad Masri <amasri@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18orinoco: avoid assertion in case of NULL pointerAditya Pakki
In ezusb_init, if upriv is NULL, the code crashes. However, the caller in ezusb_probe can handle the error and print the failure message. The patch replaces the BUG_ON call to error return. Signed-off-by: Aditya Pakki <pakki001@umn.edu> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: Keep OOB wake-interrupt disabled when it shouldn't be enabledDmitry Osipenko
NVIDIA Tegra SoCs do not like when OOB wake is enabled and WiFi interface is in DOWN state during suspend. This results in a CPU hang on programming OOB wake-up state of the GPIO controller during of system's suspend. The solution is trivial: don't enable wake for the OOB interrupt when it should be disabled. This fixes hang on Tegra20 (Acer A500) and Tegra30 (Nexus 7) devices which are using BCM4329 and BCM4330 WiFi chips respectively. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: Fix memory leak in brcmf_usbdev_qinitNavid Emamdoost
In the implementation of brcmf_usbdev_qinit() the allocated memory for reqs is leaking if usb_alloc_urb() fails. Release reqs in the error handling path. Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: not set mbss in vif if firmware does not support MBSSWright Feng
With RSDB mode, FMAC and firmware are able to create 2 or more AP, so we should not set mbss in vif structure if firmware does not support MBSS feature. Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Soeren Moch <smoch@web.de> Reviewed-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: add RSDB condition when setting interface combinationsWright Feng
With firmware RSDB feature 1. The maximum support interface is four. 2. The maximum difference channel is two. 3. The maximum interfaces of {station/p2p client/AP} are two. 4. The maximum interface of p2p device is one. Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Soeren Moch <smoch@web.de> Reviewed-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: add support for BCM4359 SDIO chipsetSoeren Moch
BCM4359 is a 2x2 802.11 abgn+ac Dual-Band HT80 combo chip and it supports Real Simultaneous Dual Band feature. Based on a similar patch by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Soeren Moch <smoch@web.de> Acked-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com> Acked-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: make errors when setting roaming parameters non-fatalSoeren Moch
4359 dongles do not support setting roaming parameters (error -52). Do not fail the 80211 configuration in this case. Signed-off-by: Soeren Moch <smoch@web.de> Acked-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: fix rambase for 4359/9Soeren Moch
Newer 4359 chip revisions need a different rambase address. This fixes firmware download on such devices which fails otherwise. Signed-off-by: Soeren Moch <smoch@web.de> Acked-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: set F2 blocksize and watermark for 4359Chung-Hsien Hsu
Set F2 blocksize to 256 bytes and watermark to 0x40 for 4359. Also enable and configure F1 MesBusyCtrl. It fixes DMA error while having UDP bi-directional traffic. Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com> [slightly adapted for rebase on mainline linux] Signed-off-by: Soeren Moch <smoch@web.de> Reviewed-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: reset two D11 cores if chip has two D11 coresWright Feng
There are two D11 cores in RSDB chips like 4359. We have to reset two D11 cores simutaneously before firmware download, or the firmware may not be initialized correctly and cause "fw initialized failed" error. Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Soeren Moch <smoch@web.de> Reviewed-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rtlwifi: rtl8192de: use generic rtl_signal_scale_mappingMichael Straube
Function _rtl92de_signal_scale_mapping is identical to the generic version rtl_signal_scale_mapping. Remove _rtl92de_signal_scale_mapping and use the generic function. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rtlwifi: rtl8192cu: use generic rtl_signal_scale_mappingMichael Straube
Function _rtl92c_signal_scale_mapping is identical to the generic version rtl_signal_scale_mapping. Remove _rtl92c_signal_scale_mapping and use the generic function. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rtlwifi: rtl8192ce: use generic rtl_signal_scale_mappingMichael Straube
Function _rtl92ce_signal_scale_mapping is identical to the generic version rtl_signal_scale_mapping. Remove _rtl92ce_signal_scale_mapping and use the generic function. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rtlwifi: rtl8192de: use generic rtl_query_rxpwrpercentageMichael Straube
Function _rtl92d_query_rxpwrpercentage is identical to the generic version rtl_query_rxpwrpercentage. Remove _rtl92d_query_rxpwrpercentage and use the generic function. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rtlwifi: rtl8192cu: use generic rtl_query_rxpwrpercentageMichael Straube
Function _rtl92c_query_rxpwrpercentage is identical to the generic version rtl_query_rxpwrpercentage. Remove _rtl92c_query_rxpwrpercentage and use the generic function. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rtlwifi: rtl8192ce: use generic rtl_query_rxpwrpercentageMichael Straube
Function _rtl92c_query_rxpwrpercentage is identical to the generic version rtl_query_rxpwrpercentage. Remove _rtl92c_query_rxpwrpercentage and use the generic function. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18zd1211rw: fix storage endpoint lookupJohan Hovold
Make sure to use the current alternate setting when verifying the storage interface descriptors to avoid submitting an URB to an invalid endpoint. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: a1030e92c150 ("[PATCH] zd1211rw: Convert installer CDROM device into WLAN device") Cc: stable <stable@vger.kernel.org> # 2.6.19 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rsi_91x_usb: fix interface sanity checkJohan Hovold
Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver") Cc: stable <stable@vger.kernel.org> # 3.15 Cc: Fariya Fatima <fariyaf@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rtl8xxxu: fix interface sanity checkJohan Hovold
Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") Cc: stable <stable@vger.kernel.org> # 4.4 Cc: Jes Sorensen <Jes.Sorensen@redhat.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18orinoco_usb: fix interface sanity checkJohan Hovold
Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 9afac70a7305 ("orinoco: add orinoco_usb driver") Cc: stable <stable@vger.kernel.org> # 2.6.35 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: fix interface sanity checkJohan Hovold
Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") Cc: stable <stable@vger.kernel.org> # 3.4 Cc: Arend van Spriel <arend@broadcom.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18at76c50x-usb: fix endpoint debug messageJohan Hovold
Make sure to use the current alternate setting, which may not be the same as the first alternate setting, also when printing the number of endpoints at probe. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: set interface carrier to off by defaultRafał Miłecki
It's important as brcmfmac creates one main interface for each PHY and doesn't allow deleting it. Not setting carrier could result in other subsystems misbehaving (e.g. LEDs "netdev" trigger turning LED on). Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18mwifiex: delete unused mwifiex_get_intf_num()Brian Norris
Commit 7afb94da3cd8 ("mwifiex: update set_mac_address logic") fixed the only user of this function, partly because the author seems to have noticed that, as written, it's on the borderline between highly misleading and buggy. Anyway, no sense in keeping dead code around: let's drop it. Fixes: 7afb94da3cd8 ("mwifiex: update set_mac_address logic") Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rt2x00usb: Fix a warning message in 'rt2x00usb_watchdog_tx_dma()'Christophe JAILLET
'forced' is duplicated in the message, axe one of them. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18brcmfmac: Fix use after free in brcmf_sdio_readframes()Dan Carpenter
The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a static checker warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes() error: dereferencing freed memory 'pkt' It looks like there was supposed to be a continue after we free "pkt". Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rsi: add missing endpoint sanity checksJohan Hovold
The driver expects at least one bulk-in endpoint when in "wifi-alone" operating mode and two bulk-in endpoints otherwise, and would otherwise fail to to submit the corresponding bulk URB to the default pipe during probe with a somewhat cryptic message: rsi_91x: rsi_rx_urb_submit: Failed in urb submission rsi_91x: rsi_probe: Failed in probe...Exiting RSI-USB WLAN: probe of 2-2.4:1.0 failed with error -8 The current endpoint sanity check looks broken and would only bail out early if there was no bulk-in endpoint but at least one bulk-out endpoint. Tighten this check to always require at least one bulk-in and one bulk-out endpoint, and add the missing sanity check for a Bluetooth bulk-in endpoint when in a BT operating mode. Also make sure to log an informative error message when the expected endpoints are missing. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rsi: fix non-atomic allocation in completion handlerJohan Hovold
USB completion handlers are called in atomic context and must specifically not allocate memory using GFP_KERNEL. Fixes: a1854fae1414 ("rsi: improve RX packet handling in USB interface") Cc: stable <stable@vger.kernel.org> # 4.17 Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rsi: fix memory leak on failed URB submissionJohan Hovold
Make sure to free the skb on failed receive-URB submission (e.g. on disconnect or currently also due to a missing endpoint). Fixes: a1854fae1414 ("rsi: improve RX packet handling in USB interface") Cc: stable <stable@vger.kernel.org> # 4.17 Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rsi: fix use-after-free on probe errorsJohan Hovold
The driver would fail to stop the command timer in most error paths, something which specifically could lead to the timer being freed while still active on I/O errors during probe. Fix this by making sure that each function starting the timer also stops it in all relevant error paths. Reported-by: syzbot+1d1597a5aa3679c65b9f@syzkaller.appspotmail.com Fixes: b78e91bcfb33 ("rsi: Add new firmware loading method") Cc: stable <stable@vger.kernel.org> # 4.12 Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rsi: fix use-after-free on failed probe and unbindJohan Hovold
Make sure to stop both URBs before returning after failed probe as well as on disconnect to avoid use-after-free in the completion handler. Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint") Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver") Cc: stable <stable@vger.kernel.org> # 3.15 Cc: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com> Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com> Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com> Cc: Fariya Fatima <fariyaf@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rt2x00: use RESET state bit to prevent IV changes on restartStanislaw Gruszka
We can not set IV when we are under reset. Previously we read previous IV value from registers and zeroed IV registers when key was deleted, but this could possibly not work if DEL_KEY command was not performed. Now when we have ->reconfig_complete ops and we fully mark mac80211 reset state via DEVICE_STATE_RESET flag, we can just skip setting IV when keys are set during reset. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rt2x00: implement reconfig_completeStanislaw Gruszka
mac80211 has .reconfig_complete that can be used as indicator of HW restart end. This will allow to configure keys/IV differently for HW restart and normal configuration. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18rtlwifi: rtl_pci: Fix -Wcast-function-typePhong Tran
correct usage prototype of callback in tasklet_init(). Report by https://github.com/KSPP/linux/issues/20 Signed-off-by: Phong Tran <tranmanphong@gmail.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-12-18iwlegacy: Fix -Wcast-function-typePhong Tran
correct usage prototype of callback in tasklet_init(). Report by https://github.com/KSPP/linux/issues/20 Signed-off-by: Phong Tran <tranmanphong@gmail.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>