Unverified Commit ccb61b43 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4979 CVE-2021-47028 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ziyang Xuan <william.xuanziyang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/PD524UQ3K3XSNGZT4YHCOLKM2O6MFYTO/ 
Patchset for CVE-2021-47028.

Ryder Lee (2):
  mt76: mt7915: rename mt7915_mcu_get_rate_info to
    mt7915_mcu_get_tx_rate
  mt76: mt7915: fix txrate reporting


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I94J23 
 
Link:https://gitee.com/openeuler/kernel/pulls/4979

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 2644e97c 3e61c5b6

drivers/net/wireless/mediatek/mt76/mt7915/mac.c

+1 −1
Original line number Diff line number Diff line
@@ -1320,7 +1320,7 @@ mt7915_mac_sta_stats_work(struct mt7915_phy *phy) 
		spin_unlock_bh(&dev->sta_poll_lock);



		/* use MT_TX_FREE_RATE to report Tx rate for further devices */

		mt7915_mcu_get_rate_info(dev, RATE_CTRL_RU_INFO, msta->wcid.idx);

		mt7915_mcu_get_tx_rate(dev, RATE_CTRL_RU_INFO, msta->wcid.idx);



		spin_lock_bh(&dev->sta_poll_lock);

	}

drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

+27 −17
Original line number Diff line number Diff line
@@ -418,54 +418,62 @@ mt7915_mcu_rx_radar_detected(struct mt7915_dev *dev, struct sk_buff *skb) 
	dev->hw_pattern++;

}



static void

mt7915_mcu_tx_rate_cal(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,

static int

mt7915_mcu_tx_rate_parse(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra,

			 struct rate_info *rate, u16 r)

{

	struct ieee80211_supported_band *sband;

	u16 ru_idx = le16_to_cpu(ra->ru_idx);

	u16 flags = 0;

	bool cck = false;



	rate->mcs = FIELD_GET(MT_RA_RATE_MCS, r);

	rate->nss = FIELD_GET(MT_RA_RATE_NSS, r) + 1;



	switch (FIELD_GET(MT_RA_RATE_TX_MODE, r)) {

	case MT_PHY_TYPE_CCK:

		cck = true;

		fallthrough;

	case MT_PHY_TYPE_OFDM:

		if (mphy->chandef.chan->band == NL80211_BAND_5GHZ)

			sband = &mphy->sband_5g.sband;

		else

			sband = &mphy->sband_2g.sband;



		rate->mcs = mt76_get_rate(mphy->dev, sband, rate->mcs, cck);

		rate->legacy = sband->bitrates[rate->mcs].bitrate;

		break;

	case MT_PHY_TYPE_HT:

	case MT_PHY_TYPE_HT_GF:

		rate->mcs += (rate->nss - 1) * 8;

		flags |= RATE_INFO_FLAGS_MCS;

		if (rate->mcs > 31)

			return -EINVAL;



		rate->flags = RATE_INFO_FLAGS_MCS;

		if (ra->gi)

			flags |= RATE_INFO_FLAGS_SHORT_GI;

			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;

		break;

	case MT_PHY_TYPE_VHT:

		flags |= RATE_INFO_FLAGS_VHT_MCS;

		if (rate->mcs > 9)

			return -EINVAL;



		rate->flags = RATE_INFO_FLAGS_VHT_MCS;

		if (ra->gi)

			flags |= RATE_INFO_FLAGS_SHORT_GI;

			rate->flags |= RATE_INFO_FLAGS_SHORT_GI;

		break;

	case MT_PHY_TYPE_HE_SU:

	case MT_PHY_TYPE_HE_EXT_SU:

	case MT_PHY_TYPE_HE_TB:

	case MT_PHY_TYPE_HE_MU:

		if (ra->gi > NL80211_RATE_INFO_HE_GI_3_2 || rate->mcs > 11)

			return -EINVAL;



		rate->he_gi = ra->gi;

		rate->he_dcm = FIELD_GET(MT_RA_RATE_DCM_EN, r);



		flags |= RATE_INFO_FLAGS_HE_MCS;

		rate->flags = RATE_INFO_FLAGS_HE_MCS;

		break;

	default:

		break;

		return -EINVAL;

	}

	rate->flags = flags;



	if (ru_idx) {

		switch (ru_idx) {
@@ -502,6 +510,8 @@ mt7915_mcu_tx_rate_cal(struct mt76_phy *mphy, struct mt7915_mcu_ra_info *ra, 
			break;

		}

	}



	return 0;

}



static void
@@ -532,11 +542,11 @@ mt7915_mcu_tx_rate_report(struct mt7915_dev *dev, struct sk_buff *skb) 
		mphy = dev->mt76.phy2;



	/* current rate */

	mt7915_mcu_tx_rate_cal(mphy, ra, &rate, curr);

	if (!mt7915_mcu_tx_rate_parse(mphy, ra, &rate, curr))

		stats->tx_rate = rate;



	/* probing rate */

	mt7915_mcu_tx_rate_cal(mphy, ra, &prob_rate, probe);

	if (!mt7915_mcu_tx_rate_parse(mphy, ra, &prob_rate, probe))

		stats->prob_rate = prob_rate;



	if (attempts) {
@@ -3263,7 +3273,7 @@ int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index) 
				   sizeof(req), true);

}



int mt7915_mcu_get_rate_info(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)

int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx)

{

	struct {

		__le32 cmd;

drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h

+1 −1
Original line number Diff line number Diff line
@@ -327,8 +327,8 @@ int mt7915_mcu_set_pulse_th(struct mt7915_dev *dev, 
			    const struct mt7915_dfs_pulse *pulse);

int mt7915_mcu_set_radar_th(struct mt7915_dev *dev, int index,

			    const struct mt7915_dfs_pattern *pattern);

int mt7915_mcu_get_rate_info(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx);

int mt7915_mcu_get_temperature(struct mt7915_dev *dev, int index);

int mt7915_mcu_get_tx_rate(struct mt7915_dev *dev, u32 cmd, u16 wlan_idx);

int mt7915_mcu_rdd_cmd(struct mt7915_dev *dev, enum mt7915_rdd_cmd cmd,

		       u8 index, u8 rx_sel, u8 val);

int mt7915_mcu_fw_log_2_host(struct mt7915_dev *dev, u8 ctrl);