Commit f5aec775 authored Nov 26, 2024 by Emmanuel Grumbach Committed by Liu Jian Nov 26, 2024

wifi: iwlwifi: mvm: disconnect station vifs if recovery failed

stable inclusion
from stable-v5.10.229
commit 66e35e42f51e897dde6186229ace3a8079446a4d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQF
CVE: CVE-2024-53059

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=66e35e42f51e897dde6186229ace3a8079446a4d



-------------------------------------------------

[ Upstream commit e50a88e5cb8792cc416866496288c5f4d1eb4b1f ]

This will allow to reconnect immediately instead of leaving the
connection in a limbo state.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240128084842.e90531cd3a36.Iebdc9483983c0d8497f9dcf9d79ec37332a5fdcc@changeid


Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Stable-dep-of: 07a6e3b78a65 ("wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Liu Jian <liujian56@huawei.com>

parent 14fe450e

drivers/net/wireless/intel/iwlwifi/mvm/fw.c

+13 −1

Original line number	Diff line number	Diff line
		@@ -1251,6 +1251,13 @@ static void iwl_mvm_lari_cfg(struct iwl_mvm *mvm)
		}
		#endif /* CONFIG_ACPI */

		static void iwl_mvm_disconnect_iterator(void data, u8 mac,
		struct ieee80211_vif *vif)
		{
		if (vif->type == NL80211_IFTYPE_STATION)
		ieee80211_hw_restart_disconnect(vif);
		}

		void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
		{
		u32 error_log_size = mvm->fw->ucode_capa.error_log_size;
		@@ -1295,10 +1302,15 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
		/* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */
		if (flags & ERROR_RECOVERY_UPDATE_DB) {
		resp = le32_to_cpu((__le32 )host_cmd.resp_pkt->data);
		if (resp)
		if (resp) {
		IWL_ERR(mvm,
		"Failed to send recovery cmd blob was invalid %d\n",
		resp);

		ieee80211_iterate_interfaces(mvm->hw, 0,
		iwl_mvm_disconnect_iterator,
		mvm);
		}
		}
		}