Commit 5e7a2c64 authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'wireless-drivers-2021-06-03' of... 

Merge tag 'wireless-drivers-2021-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers



Kalle Valo says:

====================
wireless-drivers fixes for v5.13

We have only mt76 fixes this time, most important being the fix for
A-MSDU injection attacks.

mt76

* mitigate A-MSDU injection attacks (CVE-2020-24588)

* fix possible array out of bound access in mt7921_mcu_tx_rate_report

* various aggregation and HE setting fixes

* suspend/resume fix for pci devices

* mt7615: fix crash when runtime-pm is not supported
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 59607863 d4826d17

drivers/net/wireless/mediatek/mt76/mac80211.c

+26 −0
Original line number Diff line number Diff line
@@ -514,10 +514,36 @@ EXPORT_SYMBOL_GPL(mt76_free_device); 
static void mt76_rx_release_amsdu(struct mt76_phy *phy, enum mt76_rxq_id q)

{

	struct sk_buff *skb = phy->rx_amsdu[q].head;

	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;

	struct mt76_dev *dev = phy->dev;



	phy->rx_amsdu[q].head = NULL;

	phy->rx_amsdu[q].tail = NULL;



	/*

	 * Validate if the amsdu has a proper first subframe.

	 * A single MSDU can be parsed as A-MSDU when the unauthenticated A-MSDU

	 * flag of the QoS header gets flipped. In such cases, the first

	 * subframe has a LLC/SNAP header in the location of the destination

	 * address.

	 */

	if (skb_shinfo(skb)->frag_list) {

		int offset = 0;



		if (!(status->flag & RX_FLAG_8023)) {

			offset = ieee80211_get_hdrlen_from_skb(skb);



			if ((status->flag &

			     (RX_FLAG_DECRYPTED | RX_FLAG_IV_STRIPPED)) ==

			    RX_FLAG_DECRYPTED)

				offset += 8;

		}



		if (ether_addr_equal(skb->data + offset, rfc1042_header)) {

			dev_kfree_skb(skb);

			return;

		}

	}

	__skb_queue_tail(&dev->rx_skb[q], skb);

}

drivers/net/wireless/mediatek/mt76/mt7615/init.c

+0 −1
Original line number Diff line number Diff line
@@ -510,7 +510,6 @@ void mt7615_init_device(struct mt7615_dev *dev) 
	mutex_init(&dev->pm.mutex);

	init_waitqueue_head(&dev->pm.wait);

	spin_lock_init(&dev->pm.txq_lock);

	set_bit(MT76_STATE_PM, &dev->mphy.state);

	INIT_DELAYED_WORK(&dev->mphy.mac_work, mt7615_mac_work);

	INIT_DELAYED_WORK(&dev->phy.scan_work, mt7615_scan_work);

	INIT_DELAYED_WORK(&dev->coredump.work, mt7615_coredump_work);

drivers/net/wireless/mediatek/mt76/mt7615/mac.c

+3 −2
Original line number Diff line number Diff line
@@ -1912,6 +1912,7 @@ void mt7615_pm_wake_work(struct work_struct *work) 
			napi_schedule(&dev->mt76.napi[i]);

		mt76_connac_pm_dequeue_skbs(mphy, &dev->pm);

		mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_WM], false);

		if (test_bit(MT76_STATE_RUNNING, &mphy->state))

			ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work,

						     MT7615_WATCHDOG_TIME);

	}

drivers/net/wireless/mediatek/mt76/mt7615/sdio_mcu.c

+12 −7
Original line number Diff line number Diff line
@@ -51,16 +51,13 @@ mt7663s_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb, 
	return ret;

}



static int mt7663s_mcu_drv_pmctrl(struct mt7615_dev *dev)

static int __mt7663s_mcu_drv_pmctrl(struct mt7615_dev *dev)

{

	struct sdio_func *func = dev->mt76.sdio.func;

	struct mt76_phy *mphy = &dev->mt76.phy;

	u32 status;

	int ret;



	if (!test_and_clear_bit(MT76_STATE_PM, &mphy->state))

		goto out;



	sdio_claim_host(func);



	sdio_writel(func, WHLPCR_FW_OWN_REQ_CLR, MCR_WHLPCR, NULL);
@@ -76,13 +73,21 @@ static int mt7663s_mcu_drv_pmctrl(struct mt7615_dev *dev) 
	}



	sdio_release_host(func);



out:

	dev->pm.last_activity = jiffies;



	return 0;

}



static int mt7663s_mcu_drv_pmctrl(struct mt7615_dev *dev)

{

	struct mt76_phy *mphy = &dev->mt76.phy;



	if (test_and_clear_bit(MT76_STATE_PM, &mphy->state))

		return __mt7663s_mcu_drv_pmctrl(dev);



	return 0;

}



static int mt7663s_mcu_fw_pmctrl(struct mt7615_dev *dev)

{

	struct sdio_func *func = dev->mt76.sdio.func;
@@ -123,7 +128,7 @@ int mt7663s_mcu_init(struct mt7615_dev *dev) 
	struct mt7615_mcu_ops *mcu_ops;

	int ret;



	ret = mt7663s_mcu_drv_pmctrl(dev);

	ret = __mt7663s_mcu_drv_pmctrl(dev);

	if (ret)

		return ret;

drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c

+0 −3
Original line number Diff line number Diff line
@@ -55,10 +55,7 @@ int mt7663u_mcu_init(struct mt7615_dev *dev) 


	dev->mt76.mcu_ops = &mt7663u_mcu_ops,



	/* usb does not support runtime-pm */

	clear_bit(MT76_STATE_PM, &dev->mphy.state);

	mt76_set(dev, MT_UDMA_TX_QSEL, MT_FW_DL_EN);



	if (test_and_clear_bit(MT76_STATE_POWER_OFF, &dev->mphy.state)) {

		mt7615_mcu_restart(&dev->mt76);

		if (!mt76_poll_msec(dev, MT_CONN_ON_MISC,