Commit 91018bbc authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'wireless-2022-11-03' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless 

Kalle Valo says:

====================
wireless fixes for v6.1

Second set of fixes for v6.1. Some fixes to char type usage in
drivers, memory leaks in the stack and also functionality fixes. The
rt2x00 char type fix is a larger (but still simple) commit, otherwise
the fixes are small in size.

* tag 'wireless-2022-11-03' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: ath11k: avoid deadlock during regulatory update in ath11k_regd_update()
  wifi: ath11k: Fix QCN9074 firmware boot on x86
  wifi: mac80211: Set TWT Information Frame Disabled bit as 1
  wifi: mac80211: Fix ack frame idr leak when mesh has no route
  wifi: mac80211: fix general-protection-fault in ieee80211_subif_start_xmit()
  wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
  wifi: airo: do not assign -1 to unsigned char
  wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
  wifi: cfg80211: Fix bitrates overflow issue
  wifi: cfg80211: fix memory leak in query_regdb_file()
  wifi: mac80211: fix memory free error when registering wiphy fail
  wifi: cfg80211: silence a sparse RCU warning
  wifi: rt2x00: use explicitly signed or unsigned types
====================

Link: https://lore.kernel.org/r/20221103125315.04E57C433C1@smtp.kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 9e4b7a99 f45cb6b2

drivers/net/wireless/ath/ath11k/qmi.h

+1 −1
Original line number Diff line number Diff line
@@ -27,7 +27,7 @@ 
#define ATH11K_QMI_WLANFW_MAX_NUM_MEM_SEG_V01	52

#define ATH11K_QMI_CALDB_SIZE			0x480000

#define ATH11K_QMI_BDF_EXT_STR_LENGTH		0x20

#define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT	3

#define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT	5



#define QMI_WLFW_REQUEST_MEM_IND_V01		0x0035

#define QMI_WLFW_FW_MEM_READY_IND_V01		0x0037

drivers/net/wireless/ath/ath11k/reg.c

+1 −5
Original line number Diff line number Diff line
@@ -287,11 +287,7 @@ int ath11k_regd_update(struct ath11k *ar) 
		goto err;

	}



	rtnl_lock();

	wiphy_lock(ar->hw->wiphy);

	ret = regulatory_set_wiphy_regd_sync(ar->hw->wiphy, regd_copy);

	wiphy_unlock(ar->hw->wiphy);

	rtnl_unlock();

	ret = regulatory_set_wiphy_regd(ar->hw->wiphy, regd_copy);



	kfree(regd_copy);

drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c

+4 −0
Original line number Diff line number Diff line
@@ -228,6 +228,10 @@ static void brcmf_fweh_event_worker(struct work_struct *work) 
			  brcmf_fweh_event_name(event->code), event->code,

			  event->emsg.ifidx, event->emsg.bsscfgidx,

			  event->emsg.addr);

		if (event->emsg.bsscfgidx >= BRCMF_MAX_IFS) {

			bphy_err(drvr, "invalid bsscfg index: %u\n", event->emsg.bsscfgidx);

			goto event_free;

		}



		/* convert event message */

		emsg_be = &event->emsg;

drivers/net/wireless/cisco/airo.c

+14 −4
Original line number Diff line number Diff line
@@ -5232,7 +5232,7 @@ static int get_wep_tx_idx(struct airo_info *ai) 
	return -1;

}



static int set_wep_key(struct airo_info *ai, u16 index, const char *key,

static int set_wep_key(struct airo_info *ai, u16 index, const u8 *key,

		       u16 keylen, int perm, int lock)

{

	static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 };
@@ -5283,7 +5283,7 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file) 
	struct net_device *dev = pde_data(inode);

	struct airo_info *ai = dev->ml_priv;

	int i, rc;

	char key[16];

	u8 key[16];

	u16 index = 0;

	int j = 0;
@@ -5311,12 +5311,22 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file) 
	}



	for (i = 0; i < 16*3 && data->wbuffer[i+j]; i++) {

		int val;



		if (i % 3 == 2)

			continue;



		val = hex_to_bin(data->wbuffer[i+j]);

		if (val < 0) {

			airo_print_err(ai->dev->name, "WebKey passed invalid key hex");

			return;

		}

		switch(i%3) {

		case 0:

			key[i/3] = hex_to_bin(data->wbuffer[i+j])<<4;

			key[i/3] = (u8)val << 4;

			break;

		case 1:

			key[i/3] |= hex_to_bin(data->wbuffer[i+j]);

			key[i/3] |= (u8)val;

			break;

		}

	}

drivers/net/wireless/mac80211_hwsim.c

+5 −0
Original line number Diff line number Diff line
@@ -910,6 +910,7 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac, 
	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;

	struct sk_buff *skb;

	struct ieee80211_hdr *hdr;

	struct ieee80211_tx_info *cb;



	if (!vp->assoc)

		return;
@@ -931,6 +932,10 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac, 
	memcpy(hdr->addr2, mac, ETH_ALEN);

	memcpy(hdr->addr3, vp->bssid, ETH_ALEN);



	cb = IEEE80211_SKB_CB(skb);

	cb->control.rates[0].count = 1;

	cb->control.rates[1].idx = -1;



	rcu_read_lock();

	mac80211_hwsim_tx_frame(data->hw, skb,

				rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);