1. 04 Nov, 2022 7 commits
    • Bitterblue Smith's avatar
      wifi: rtl8xxxu: Add central frequency offset tracking · 57b328bc
      Bitterblue Smith authored
      According to Realtek programmers, "to adjust oscillator to align
      central frequency of connected AP. Then, it can yield better
      performance." From commit fb8517f4 ("rtw88: 8822c: add CFO
      tracking").
      
      The RTL8192CU and a version of RTL8723AU apparently don't have the
      ability to adjust the oscillator, so this doesn't apply to them.
      
      This also doesn't apply to the wifi + bluetooth combo chips (RTL8723AU
      and RTL8723BU) because the CFO tracking should only be done when
      bluetooth is disabled, and determining that looked complicated.
      
      That leaves only the RTL8192EU and RTL8188FU chips. I tested this with
      the latter.
      Signed-off-by: default avatarBitterblue Smith <rtl8821cerfe2@gmail.com>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/80aba428-0aff-f4b2-dea5-35d1425982b6@gmail.com
      57b328bc
    • Jisoo Jang's avatar
      wifi: brcmfmac: Fix potential NULL pointer dereference in 'brcmf_c_preinit_dcmds()' · 683b9728
      Jisoo Jang authored
      This patch fixes a NULL pointer dereference bug in brcmfmac that occurs
      when ptr which is NULL pointer passed as an argument of strlcpy() in
      brcmf_c_preinit_dcmds(). This happens when the driver passes a firmware
      version string that does not contain a space " ", making strrchr()
      return a null pointer. This patch adds a null pointer check.
      
      Found by a modified version of syzkaller.
      
      KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
      CPU: 0 PID: 1983 Comm: kworker/0:2 Not tainted 5.14.0+ #79
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
      rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
      Workqueue: usb_hub_wq hub_event
      RIP: 0010:strlen+0x1a/0x90
      Code: 23 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 48 b8 00 00 00 00
      00 fc ff df 48 89 fa 55 48 89 fd 48 c1 ea 03 53 48 83 ec 08 <0f> b6 04
      02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 48 80 7d 00 00
      RSP: 0018:ffffc90002bfedd8 EFLAGS: 00010296
      RAX: dffffc0000000000 RBX: 1ffff9200057fdc1 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 0000000000000020 RDI: 0000000000000001
      RBP: 0000000000000001 R08: 0000000000000039 R09: ffffed1023549801
      R10: ffff88811aa4c007 R11: ffffed1023549800 R12: ffff88800bc68d6c
      R13: ffffc90002bfef08 R14: ffff88800bc6bc7c R15: 0000000000000001
      FS:  0000000000000000(0000) GS:ffff88811aa00000(0000)
      knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000020546180 CR3: 0000000117ff1000 CR4: 0000000000750ef0
      PKRU: 55555554
      Call Trace:
       brcmf_c_preinit_dcmds+0x9f2/0xc40
       ? brcmf_c_set_joinpref_default+0x100/0x100
       ? rcu_read_lock_sched_held+0xa1/0xd0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? lock_acquire+0x19d/0x4e0
       ? find_held_lock+0x2d/0x110
       ? brcmf_usb_deq+0x1a7/0x260
       ? brcmf_usb_rx_fill_all+0x5a/0xf0
       brcmf_attach+0x246/0xd40
       ? wiphy_new_nm+0x1703/0x1dd0
       ? kmemdup+0x43/0x50
       brcmf_usb_probe+0x12de/0x1690
       ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
       usb_probe_interface+0x2aa/0x760
       ? usb_probe_device+0x250/0x250
       really_probe+0x205/0xb70
       ? driver_allows_async_probing+0x130/0x130
       __driver_probe_device+0x311/0x4b0
       ? driver_allows_async_probing+0x130/0x130
       driver_probe_device+0x4e/0x150
       __device_attach_driver+0x1cc/0x2a0
       bus_for_each_drv+0x156/0x1d0
       ? bus_rescan_devices+0x30/0x30
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       ? trace_hardirqs_on+0x46/0x160
       __device_attach+0x23f/0x3a0
       ? device_bind_driver+0xd0/0xd0
       ? kobject_uevent_env+0x287/0x14b0
       bus_probe_device+0x1da/0x290
       device_add+0xb7b/0x1eb0
       ? wait_for_completion+0x290/0x290
       ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0
       usb_set_configuration+0xf59/0x16f0
       usb_generic_driver_probe+0x82/0xa0
       usb_probe_device+0xbb/0x250
       ? usb_suspend+0x590/0x590
       really_probe+0x205/0xb70
       ? driver_allows_async_probing+0x130/0x130
       __driver_probe_device+0x311/0x4b0
       ? usb_generic_driver_match+0x75/0x90
       ? driver_allows_async_probing+0x130/0x130
       driver_probe_device+0x4e/0x150
       __device_attach_driver+0x1cc/0x2a0
       bus_for_each_drv+0x156/0x1d0
       ? bus_rescan_devices+0x30/0x30
       ? _raw_spin_unlock_irqrestore+0x47/0x50
       __device_attach+0x23f/0x3a0
       ? device_bind_driver+0xd0/0xd0
       ? kobject_uevent_env+0x287/0x14b0
       bus_probe_device+0x1da/0x290
       device_add+0xb7b/0x1eb0
       ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0
       ? kfree+0x14a/0x6b0
       ? __usb_get_extra_descriptor+0x116/0x160
       usb_new_device.cold+0x49c/0x1029
       ? hub_disconnect+0x450/0x450
       ? rwlock_bug.part.0+0x90/0x90
       ? _raw_spin_unlock_irq+0x24/0x30
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       hub_event+0x248b/0x31c9
       ? usb_port_suspend.cold+0x139/0x139
       ? check_irq_usage+0x861/0xf20
       ? drain_workqueue+0x280/0x360
       ? lock_release+0x640/0x640
       ? rcu_read_lock_sched_held+0xa1/0xd0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       process_one_work+0x92b/0x1460
       ? pwq_dec_nr_in_flight+0x330/0x330
       ? rwlock_bug.part.0+0x90/0x90
       worker_thread+0x95/0xe00
       ? __kthread_parkme+0x115/0x1e0
       ? process_one_work+0x1460/0x1460
       kthread+0x3a1/0x480
       ? set_kthread_struct+0x120/0x120
       ret_from_fork+0x1f/0x30
      Modulesdd linked in:
      ---[ end trace c112c68924ddd800 ]---
      RIP: 0010:strlen+0x1a/0x90
      Code: 23 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 48 b8 00 00 00 00
      00 fc ff df 48 89 fa 55 48 89 fd 48 c1 ea 03 53 48 83 ec 08 <0f> b6 04
      02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 48 80 7d 00 00
      RSP: 0018:ffffc90002bfedd8 EFLAGS: 00010296
      RAX: dffffc0000000000 RBX: 1ffff9200057fdc1 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 0000000000000020 RDI: 0000000000000001
      RBP: 0000000000000001 R08: 0000000000000039 R09: ffffed1023549801
      R10: ffff88811aa4c007 R11: ffffed1023549800 R12: ffff88800bc68d6c
      R13: ffffc90002bfef08 R14: ffff88800bc6bc7c R15: 0000000000000001
      FS:  0000000000000000(0000) GS:ffff88811aa00000(0000)
      knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000020546180 CR3: 0000000117ff1000 CR4: 0000000000750ef0
      PKRU: 55555554
      Kernel panic - not syncing: Fatal exception
      Kernel Offset: disabled
      Reported-by: default avatarDokyung Song <dokyungs@yonsei.ac.kr>
      Reported-by: default avatarJisoo Jang <jisoo.jang@yonsei.ac.kr>
      Reported-by: default avatarMinsuk Kang <linuxlovemin@yonsei.ac.kr>
      Signed-off-by: default avatarJisoo Jang <jisoo.jang@yonsei.ac.kr>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221101183642.166450-1-jisoo.jang@yonsei.ac.kr
      683b9728
    • Jonathan Neuschäfer's avatar
    • Colin Ian King's avatar
      wifi: rtlwifi: rtl8192ee: remove static variable stop_report_cnt · cdeee854
      Colin Ian King authored
      Variable stop_report_cnt is being set or incremented but is never
      being used for anything meaningful. The variable and code relating
      to it's use is redundant and can be removed.
      Signed-off-by: default avatarColin Ian King <colin.i.king@gmail.com>
      Acked-by: default avatarPing-Ke Shih <pkshih@realtek.com>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221031155637.871164-1-colin.i.king@gmail.com
      cdeee854
    • Linus Walleij's avatar
      bcma: Fail probe if GPIO subdriver fails · 74a47300
      Linus Walleij authored
      We currently register the BCMA core even if the GPIO portions
      fail. There is no reason for this: the GPIO should register
      just fine, if it fails the BCMA driver should fail.
      
      We already gracefully handle the case where the GPIO driver is
      not compiled in.
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221028093000.239020-1-linus.walleij@linaro.org
      74a47300
    • Linus Walleij's avatar
      bcma: Use the proper gpio include · 2b6c0e15
      Linus Walleij authored
      The <linux/bcma/bcma_driver_chipcommon.h> is including the legacy
      header <linux/gpio.h> to obtain struct gpio_chip. Instead, include
      <linux/gpio/driver.h> where this struct is defined.
      
      It turns out that the brcm80211 brcmsmac depends on this to
      bring in the symbol gpio_is_valid().
      
      The driver looks up the BCMA parent GPIO driver and checks that
      this succeeds, but then it goes on to use the deprecated GPIO
      call gpio_is_valid() to check the consistency of the .base
      member of the BCMA GPIO struct. The whole check can be dropped
      because the bcma_gpio is initialized in the declarations:
      
        struct gpio_chip *bcma_gpio = &cc_drv->gpio;
      
      And this can never be NULL.
      
      Cc: Jonas Gorski <jonas.gorski@gmail.com>
      Acked-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221028092332.238728-1-linus.walleij@linaro.org
      2b6c0e15
    • Minsuk Kang's avatar
      wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() · 81d17f6f
      Minsuk Kang authored
      This patch fixes a shift-out-of-bounds in brcmfmac that occurs in
      BIT(chiprev) when a 'chiprev' provided by the device is too large.
      It should also not be equal to or greater than BITS_PER_TYPE(u32)
      as we do bitwise AND with a u32 variable and BIT(chiprev). The patch
      adds a check that makes the function return NULL if that is the case.
      Note that the NULL case is later handled by the bus-specific caller,
      brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example.
      
      Found by a modified version of syzkaller.
      
      UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
      shift exponent 151055786 is too large for 64-bit type 'long unsigned int'
      CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
      Workqueue: usb_hub_wq hub_event
      Call Trace:
       dump_stack_lvl+0x57/0x7d
       ubsan_epilogue+0x5/0x40
       __ubsan_handle_shift_out_of_bounds.cold+0x53/0xdb
       ? lock_chain_count+0x20/0x20
       brcmf_fw_alloc_request.cold+0x19/0x3ea
       ? brcmf_fw_get_firmwares+0x250/0x250
       ? brcmf_usb_ioctl_resp_wait+0x1a7/0x1f0
       brcmf_usb_get_fwname+0x114/0x1a0
       ? brcmf_usb_reset_resume+0x120/0x120
       ? number+0x6c4/0x9a0
       brcmf_c_process_clm_blob+0x168/0x590
       ? put_dec+0x90/0x90
       ? enable_ptr_key_workfn+0x20/0x20
       ? brcmf_common_pd_remove+0x50/0x50
       ? rcu_read_lock_sched_held+0xa1/0xd0
       brcmf_c_preinit_dcmds+0x673/0xc40
       ? brcmf_c_set_joinpref_default+0x100/0x100
       ? rcu_read_lock_sched_held+0xa1/0xd0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? lock_acquire+0x19d/0x4e0
       ? find_held_lock+0x2d/0x110
       ? brcmf_usb_deq+0x1cc/0x260
       ? mark_held_locks+0x9f/0xe0
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       ? _raw_spin_unlock_irqrestore+0x47/0x50
       ? trace_hardirqs_on+0x1c/0x120
       ? brcmf_usb_deq+0x1a7/0x260
       ? brcmf_usb_rx_fill_all+0x5a/0xf0
       brcmf_attach+0x246/0xd40
       ? wiphy_new_nm+0x1476/0x1d50
       ? kmemdup+0x30/0x40
       brcmf_usb_probe+0x12de/0x1690
       ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
       usb_probe_interface+0x25f/0x710
       really_probe+0x1be/0xa90
       __driver_probe_device+0x2ab/0x460
       ? usb_match_id.part.0+0x88/0xc0
       driver_probe_device+0x49/0x120
       __device_attach_driver+0x18a/0x250
       ? driver_allows_async_probing+0x120/0x120
       bus_for_each_drv+0x123/0x1a0
       ? bus_rescan_devices+0x20/0x20
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       ? trace_hardirqs_on+0x1c/0x120
       __device_attach+0x207/0x330
       ? device_bind_driver+0xb0/0xb0
       ? kobject_uevent_env+0x230/0x12c0
       bus_probe_device+0x1a2/0x260
       device_add+0xa61/0x1ce0
       ? __mutex_unlock_slowpath+0xe7/0x660
       ? __fw_devlink_link_to_suppliers+0x550/0x550
       usb_set_configuration+0x984/0x1770
       ? kernfs_create_link+0x175/0x230
       usb_generic_driver_probe+0x69/0x90
       usb_probe_device+0x9c/0x220
       really_probe+0x1be/0xa90
       __driver_probe_device+0x2ab/0x460
       driver_probe_device+0x49/0x120
       __device_attach_driver+0x18a/0x250
       ? driver_allows_async_probing+0x120/0x120
       bus_for_each_drv+0x123/0x1a0
       ? bus_rescan_devices+0x20/0x20
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       ? trace_hardirqs_on+0x1c/0x120
       __device_attach+0x207/0x330
       ? device_bind_driver+0xb0/0xb0
       ? kobject_uevent_env+0x230/0x12c0
       bus_probe_device+0x1a2/0x260
       device_add+0xa61/0x1ce0
       ? __fw_devlink_link_to_suppliers+0x550/0x550
       usb_new_device.cold+0x463/0xf66
       ? hub_disconnect+0x400/0x400
       ? _raw_spin_unlock_irq+0x24/0x30
       hub_event+0x10d5/0x3330
       ? hub_port_debounce+0x280/0x280
       ? __lock_acquire+0x1671/0x5790
       ? wq_calc_node_cpumask+0x170/0x2a0
       ? lock_release+0x640/0x640
       ? rcu_read_lock_sched_held+0xa1/0xd0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       process_one_work+0x873/0x13e0
       ? lock_release+0x640/0x640
       ? pwq_dec_nr_in_flight+0x320/0x320
       ? rwlock_bug.part.0+0x90/0x90
       worker_thread+0x8b/0xd10
       ? __kthread_parkme+0xd9/0x1d0
       ? process_one_work+0x13e0/0x13e0
       kthread+0x379/0x450
       ? _raw_spin_unlock_irq+0x24/0x30
       ? set_kthread_struct+0x100/0x100
       ret_from_fork+0x1f/0x30
      Reported-by: default avatarDokyung Song <dokyungs@yonsei.ac.kr>
      Reported-by: default avatarJisoo Jang <jisoo.jang@yonsei.ac.kr>
      Reported-by: default avatarMinsuk Kang <linuxlovemin@yonsei.ac.kr>
      Signed-off-by: default avatarMinsuk Kang <linuxlovemin@yonsei.ac.kr>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221024071329.504277-1-linuxlovemin@yonsei.ac.kr
      81d17f6f
  2. 01 Nov, 2022 16 commits
  3. 29 Oct, 2022 17 commits