Commit 72da9dc2 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'wireless-2022-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless 

Kalle Valo says:

====================
wireless fixes for v6.1

First set of fixes for v6.1. Quite a lot of fixes in stack but also
for mt76.

cfg80211/mac80211
 - fix locking error in mac80211's hw addr change
 - fix TX queue stop for internal TXQs
 - handling of very small (e.g. STP TCN) packets
 - two memcpy() hardening fixes
 - fix probe request 6 GHz capability warning
 - fix various connection prints
 - fix decapsulation offload for AP VLAN

mt76
 - fix rate reporting, LLC packets and receive checksum offload on specific chipsets

iwlwifi
 - fix crash due to list corruption

ath11k
 - fix a compiler warning with GCC 11 and KASAN

* tag 'wireless-2022-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: ath11k: mac: fix reading 16 bytes from a region of size 0 warning
  wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue (other cases)
  wifi: mt76: fix rx checksum offload on mt7615/mt7915/mt7921
  wifi: mt76: fix receiving LLC packets on mt7615/mt7915
  wifi: nl80211: Split memcpy() of struct nl80211_wowlan_tcp_data_token flexible array
  wifi: wext: use flex array destination for memcpy()
  wifi: cfg80211: fix ieee80211_data_to_8023_exthdr handling of small packets
  wifi: mac80211: netdev compatible TX stop for iTXQ drivers
  wifi: mac80211: fix decap offload for stations on AP_VLAN interfaces
  wifi: mac80211: unlock on error in ieee80211_can_powered_addr_change()
  wifi: mac80211: remove/avoid misleading prints
  wifi: mac80211: fix probe req HE capabilities access
  wifi: mac80211: do not drop packets smaller than the LLC-SNAP header on fast-rx
  wifi: mt76: fix rate reporting / throughput regression on mt7915 and newer
====================

Link: https://lore.kernel.org/r/20221011163123.A093CC433D6@smtp.kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 0cf3cae9 abf93f36

drivers/net/wireless/ath/ath11k/mac.c

+3 −2
Original line number Diff line number Diff line
@@ -2081,7 +2081,7 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar, 
	struct cfg80211_chan_def def;

	const struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap;

	enum nl80211_band band;

	u16 *he_mcs_mask;

	u16 he_mcs_mask[NL80211_HE_NSS_MAX];

	u8 max_nss, he_mcs;

	u16 he_tx_mcs = 0, v = 0;

	int i, he_nss, nss_idx;
@@ -2098,7 +2098,8 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar, 
		return;



	band = def.chan->band;

	he_mcs_mask = arvif->bitrate_mask.control[band].he_mcs;

	memcpy(he_mcs_mask, arvif->bitrate_mask.control[band].he_mcs,

	       sizeof(he_mcs_mask));



	if (ath11k_peer_assoc_h_he_masked(he_mcs_mask))

		return;

drivers/net/wireless/intel/iwlwifi/mvm/sta.c

+2 −0
Original line number Diff line number Diff line
@@ -384,6 +384,7 @@ static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta, 
			iwl_mvm_txq_from_tid(sta, tid);



		mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE;

		list_del_init(&mvmtxq->list);

	}



	/* Regardless if this is a reserved TXQ for a STA - mark it as false */
@@ -478,6 +479,7 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue) 
		mvmsta->tid_data[tid].txq_id = IWL_MVM_INVALID_QUEUE;



		mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE;

		list_del_init(&mvmtxq->list);

	}



	mvmsta->tfd_queue_msk &= ~BIT(queue); /* Don't use this queue anymore */

drivers/net/wireless/mediatek/mt76/dma.c

+1 −4
Original line number Diff line number Diff line
@@ -696,10 +696,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget) 


		skb_reserve(skb, q->buf_offset);



		if (q == &dev->q_rx[MT_RXQ_MCU]) {

			u32 *rxfce = (u32 *)skb->cb;

			*rxfce = info;

		}

		*(u32 *)skb->cb = info;



		__skb_put(skb, len);

		done++;

drivers/net/wireless/mediatek/mt76/mt7615/mac.c

+7 −5
Original line number Diff line number Diff line
@@ -345,6 +345,7 @@ static int mt7615_mac_fill_rx(struct mt7615_dev *dev, struct sk_buff *skb) 
	u32 rxd1 = le32_to_cpu(rxd[1]);

	u32 rxd2 = le32_to_cpu(rxd[2]);

	u32 csum_mask = MT_RXD0_NORMAL_IP_SUM | MT_RXD0_NORMAL_UDP_TCP_SUM;

	u32 csum_status = *(u32 *)skb->cb;

	bool unicast, hdr_trans, remove_pad, insert_ccmp_hdr = false;

	u16 hdr_gap;

	int phy_idx;
@@ -394,7 +395,8 @@ static int mt7615_mac_fill_rx(struct mt7615_dev *dev, struct sk_buff *skb) 
		spin_unlock_bh(&dev->sta_poll_lock);

	}



	if ((rxd0 & csum_mask) == csum_mask)

	if (mt76_is_mmio(&dev->mt76) && (rxd0 & csum_mask) == csum_mask &&

	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))

		skb->ip_summed = CHECKSUM_UNNECESSARY;



	if (rxd2 & MT_RXD2_NORMAL_FCS_ERR)
@@ -610,14 +612,14 @@ static int mt7615_mac_fill_rx(struct mt7615_dev *dev, struct sk_buff *skb) 
			 * When header translation failure is indicated,

			 * the hardware will insert an extra 2-byte field

			 * containing the data length after the protocol

			 * type field.

			 * type field. This happens either when the LLC-SNAP

			 * pattern did not match, or if a VLAN header was

			 * detected.

			 */

			pad_start = 12;

			if (get_unaligned_be16(skb->data + pad_start) == ETH_P_8021Q)

				pad_start += 4;



			if (get_unaligned_be16(skb->data + pad_start) !=

			    skb->len - pad_start - 2)

			else

				pad_start = 0;

		}

drivers/net/wireless/mediatek/mt76/mt7915/mac.c

+7 −5
Original line number Diff line number Diff line
@@ -233,6 +233,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb) 
	u8 remove_pad, amsdu_info;

	u8 mode = 0, qos_ctl = 0;

	struct mt7915_sta *msta = NULL;

	u32 csum_status = *(u32 *)skb->cb;

	bool hdr_trans;

	u16 hdr_gap;

	u16 seq_ctrl = 0;
@@ -288,7 +289,8 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb) 
	if (!sband->channels)

		return -EINVAL;



	if ((rxd0 & csum_mask) == csum_mask)

	if ((rxd0 & csum_mask) == csum_mask &&

	    !(csum_status & (BIT(0) | BIT(2) | BIT(3))))

		skb->ip_summed = CHECKSUM_UNNECESSARY;



	if (rxd1 & MT_RXD1_NORMAL_FCS_ERR)
@@ -446,14 +448,14 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb) 
			 * When header translation failure is indicated,

			 * the hardware will insert an extra 2-byte field

			 * containing the data length after the protocol

			 * type field.

			 * type field. This happens either when the LLC-SNAP

			 * pattern did not match, or if a VLAN header was

			 * detected.

			 */

			pad_start = 12;

			if (get_unaligned_be16(skb->data + pad_start) == ETH_P_8021Q)

				pad_start += 4;



			if (get_unaligned_be16(skb->data + pad_start) !=

			    skb->len - pad_start - 2)

			else

				pad_start = 0;

		}