- 22 Aug, 2023 32 commits
-
-
Lin Ma authored
The previous commit dd3e4fc7 ("nl80211/cfg80211: add BSS color to NDP ranging parameters") adds a parameter for NDP ranging by introducing a new attribute type named NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR. However, the author forgot to also describe the nla_policy at nl80211_pmsr_ftm_req_attr_policy (net/wireless/nl80211.c). Just complement it to avoid malformed attribute that causes out-of-attribute access. Fixes: dd3e4fc7 ("nl80211/cfg80211: add BSS color to NDP ranging parameters") Signed-off-by:
Lin Ma <linma@zju.edu.cn> Reviewed-by:
Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20230809033151.768910-1-linma@zju.edu.cnSigned-off-by:
Johannes Berg <johannes.berg@intel.com>
-
EN-WEI WU authored
The nlmsg_free() ends up calling kfree_skb(), and kfree_skb() is not allowed to be called from hardware interrupt context or with hardware interrupts being disabled. Replace the mistaken usage of nlmsg_free() by dev_kfree_skb_irq(), which is safe in both cases. Signed-off-by:
EN-WEI WU <enweiwu@FreeBSD.org> Link: https://lore.kernel.org/r/20230815095427.13589-1-enweiwu@FreeBSD.orgSigned-off-by:
-
Johannes Berg authored
Code inspection reveals that we switch the puncturing bitmap before the real channel switch, since that happens only in the second round of the worker after the channel context is switched by ieee80211_link_use_reserved_context(). Fixes: 2cc25e4b ("wifi: mac80211: configure puncturing bitmap") Signed-off-by:
-
Johannes Berg authored
While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address header to avoid accessing invalid memory if shorter frames are passed in. Reported-by: syzbot+b2645b5bf1512b81fa22@syzkaller.appspotmail.com Reviewed-by:
Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by:
-
Johannes Berg authored
When probing a client, first check if we have it, and then check for the channel context, otherwise you can trigger the warning there easily by probing when the AP isn't even started yet. Since a client existing means the AP is also operating, we can then keep the warning. Also simplify the moved code a bit. Reported-by: syzbot+999fac712d84878a7379@syzkaller.appspotmail.com Signed-off-by: -
Johannes Berg authored
If there's no OCB state, don't ask the driver/mac80211 to leave, since that's just confusing. Since set/clear the chandef state, that's a simple check. Reported-by: syzbot+09d1cd2f71e6dd3bfd2c@syzkaller.appspotmail.com Signed-off-by: -
Johannes Berg authored
If the AP uses our own address as its MLD address or BSSID, then clearly something's wrong. Reject such connections so we don't try and fail later. Reported-by: syzbot+2676771ed06a6df166ad@syzkaller.appspotmail.com Signed-off-by: -
Johannes Berg authored
Before checking the action code, check that it even exists in the frame. Reported-by: syzbot+be9c824e6f269d608288@syzkaller.appspotmail.com Signed-off-by: -
Avraham Stern authored
In case the SAP connection is established before the interface is added, the mac address is still not set. Don't send the nic info SAP message in this case since it will result in sending an invalid mac address. The nic info message will be sent with a valid mac address when the interface is added. Signed-off-by:
Avraham Stern <avraham.stern@intel.com> Signed-off-by:
Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230822103048.a49436bed387.I0ca88d72456e6e9f939bbc2e0c52ffb173fbc97e@changeidSigned-off-by:
-
Avraham Stern authored
When wiamt is disabled the driver up SAP message is not sent, so there is no need to send the driver down message as well. Signed-off-by:
-
Avraham Stern authored
The HOST_GOES_DOWN message should be sent even if wiamt is disabled. Otherwise wiamt may still use the shared memory (e.g. if enabled later) while it's no longer valid. Signed-off-by:
-
Avraham Stern authored
SAP messages should not be sent when AMT is disabled. Signed-off-by:
-
Avraham Stern authored
In case CSME holds the NIC and SAP connection is already established, iwl_pcie_prepare_card_hw() during iwl_pci_probe() will fail (which is fine since CSME will release the nic later when asked with a SAP message). In this case tring to grab nic access to read the crf ids will fail with a warning. Avoid the warning by only trying to read the crf ids in case prepare card succeeded. Signed-off-by:
-
Mukesh Sisodiya authored
LMAC error table address was checked against UMAC error table minimum address defined. Because of that, the LMAC error table was not read, since both addresses belong to different ranges. As addresses are updated from FW alive message and should be correct, this check is not needed. Still keep the check for address 0 to avoid NULL address read. Signed-off-by:
Mukesh Sisodiya <mukesh.sisodiya@intel.com> Signed-off-by:
-
Johannes Berg authored
Support TX flush on AP interfaces so that we will do a proper flush for frames on the queue before keys are removed. Signed-off-by:
-
Johannes Berg authored
Two new RFs were added in the code, but we forgot to add them to the list here that enables HE TX/RX 1024 QAM less than 242 tone RU. Signed-off-by:
-
Gregory Greenman authored
Add a new vendor (Razer) to PPAG approved list. Signed-off-by:
-
Johannes Berg authored
There are occasionally bugs which cause the device to try to use a TFD that it wasn't supposed to, and these are very hard to diagnose. Fill all unused TFDs with a debug command that immediately causes an error to be detected in these cases. Signed-off-by:
-
Johannes Berg authored
We need this earlier in the file next, move it up to have an easier to read change, since this moves other things in the diff git generates by default. Signed-off-by:
-
Johannes Berg authored
We will need this in another place soon in reclaim and init, so add this function to the queue header file instead. Signed-off-by:
-
Johannes Berg authored
This is only ever initialized to zero, use a new define for the default RX queue instead. Signed-off-by:
-
Johannes Berg authored
This is a bit messy right now, there are functions for both, but then gen1 function can actually deal with both gen1 and gen2, due to the confusion about use_tfh/gen2 cleaned up in the previous patch. Fix the common paths to call the right functions and remove handling of gen2 from the gen1 function. Signed-off-by:
-
Johannes Berg authored
There's no reason to warn here, it's not an internal consistency issue, we even use this to check if the device is dead, and if it read_mem() returns an error that's either because grab NIC access or memory allocation failed, both of which are already noisy. Just remove the warning entirely. Signed-off-by:
-
Johannes Berg authored
The structure name in the docs should be given in all lower case matching the actual C declaration. Signed-off-by:
-
Johannes Berg authored
If 11ax/EHT is disabled, then we shouldn't advertise MLO support either. Signed-off-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_tid_config. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by:
Kees Cook <keescook@chromium.org> Reviewed-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_scan_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_rnr_elems. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_pmsr_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_mbssid_elems. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_cqm_config. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_acl_data. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by:
Justin Stitt <justinstitt@google.com> Reviewed-by:
-
- 21 Aug, 2023 8 commits
-
-
Zong-Zhe Yang authored
Sync Realtek Regulatory R43 and Realtek Channel Plan R64. 1. add entry for XK (Kosovo) 2. change TH (Thailand) to Realtek regd world-wide 3. configures Realtek 6 GHz regd for below countries * AR, MX, HT -> FCC * LB, ZA, BF, LA, MN -> ETSI Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230815120253.9901-1-pkshih@realtek.com
-
Dan Carpenter authored
The "buf" is skb->data that comes from the firmware. We want to print "len" number of bytes. But there is a missing period so the "len" variable is used for formatting (width) instead of limiting the output (precision). Fixes: cad2bd8a ("wifi: rtw89: support firmware log with formatted text") Signed-off-by:
Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by:
-
Shiji Yang authored
For MAC_SYS_CTRL register, Bit[2] controls MAC_TX_EN and Bit[3] controls MAC_RX_EN (Bit index starts from 0). Therefore, 0x08 is the correct mask for RX. Signed-off-by:
Shiji Yang <yangshiji66@outlook.com> Acked-by:
Stanislaw Gruszka <stf_xl@wp.pl> Signed-off-by:
-
Yang Yingliang authored
Use eth_broadcast_addr() to assign broadcast address instead of memcpy(). Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com> Acked-by:
-
Kuan-Chung Chen authored
Time Averaged SAR (TAS) tracks the amount of transmit power over a period of time and adjusts the power accordingly. Two thresholds are used to determine when to increase or reduce transmit power: Dynamic Power Reduction (DPR) on/off. Compared to Static SAR, which has a constant transmit power, TAS can improve the user experience or range extension. TAS can be enabled through BIOS, and the driver will evaluate Realtek ACPI DSM with RTW89_ACPI_DSM_FUNC_TAS_EN to determine whether TAS should be enabled. Signed-off-by:
Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by:
-
Ping-Ke Shih authored
A few samples get bad performance on 2GHz band, so use proper IQK command code and select another group to have wider range of calibration value. Fixes: f2abe804 ("wifi: rtw89: 8852b: rfk: add IQK") Signed-off-by:
-
Justin Stitt authored
The current implementation seems to reinvent what `kstrtoul` already does in terms of functionality and error handling. Remove uses of `simple_strtoul()` in favor of `kstrtoul()`. There is the following note at `lib/vsprintf.c:simple_strtoull()` which further backs this change: | * This function has caveats. Please use kstrtoull (or kstrtoul) instead. And here, simple_str* are explicitly deprecated [3]. This patch also removes an instance of the deprecated `strncpy` which helps [2]. Compile tested only. Link: https://lore.kernel.org/all/202308011602.3CC1C0244C@keescook/ [1] Link: https://github.com/KSPP/linux/issues/90 [2] Link: https://docs.kernel.org/process/deprecated.html#simple-strtol-simple-strtoll-simple-strtoul-simple-strtoull [3] Cc: linux-hardening@vger.kernel.org Suggested-by:
-
Dmitry Antipov authored
Fix comment typos around ' mwifiex_deaggr_sdio_pkt()' and 'mwifiex_host_to_card_mp_aggr()'. Signed-off-by:
Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by:
-
