Age | Commit message (Collapse) | Author | Files | Lines |
|
While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving
mesh") fixed a memory leak on mesh leave / teardown it introduced a
potential memory corruption caused by a double free when rejoining the
mesh:
ieee80211_leave_mesh()
-> kfree(sdata->u.mesh.ie);
...
ieee80211_join_mesh()
-> copy_mesh_setup()
-> old_ie = ifmsh->ie;
-> kfree(old_ie);
This double free / kernel panics can be reproduced by using wpa_supplicant
with an encrypted mesh (if set up without encryption via "iw" then
ifmsh->ie is always NULL, which avoids this issue). And then calling:
$ iw dev mesh0 mesh leave
$ iw dev mesh0 mesh join my-mesh
Note that typically these commands are not used / working when using
wpa_supplicant. And it seems that wpa_supplicant or wpa_cli are going
through a NETDEV_DOWN/NETDEV_UP cycle between a mesh leave and mesh join
where the NETDEV_UP resets the mesh.ie to NULL via a memcpy of
default_mesh_setup in cfg80211_netdev_notifier_call, which then avoids
the memory corruption, too.
The issue was first observed in an application which was not using
wpa_supplicant but "Senf" instead, which implements its own calls to
nl80211.
Fixing the issue by removing the kfree()'ing of the mesh IE in the mesh
join function and leaving it solely up to the mesh leave to free the
mesh IE.
Cc: stable@vger.kernel.org
Fixes: 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh")
Reported-by: Matthias Kretschmer <mathias.kretschmer@fit.fraunhofer.de>
Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
Tested-by: Mathias Kretschmer <mathias.kretschmer@fit.fraunhofer.de>
Link: https://lore.kernel.org/r/20220310183513.28589-1-linus.luessing@c0d3.blue
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
There are no legacy rates on 60GHz or sub-1GHz band, so modify the check.
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
Link: https://lore.kernel.org/r/20220308021645.16272-1-MeiChia.Chiu@mediatek.com
[Ghz -> GHz]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
It should be NL80211_IFTYPE_OCB instead.
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Link: https://lore.kernel.org/r/1645542399-4680-1-git-send-email-quic_vjakkam@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Previous memory allocations in this function already use GFP_KERNEL, so
use __dev_alloc_skb() and an explicit GFP_KERNEL instead of an implicit
GFP_ATOMIC.
This gives more opportunities of successful allocation.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/194a0e2ff00c3fae88cc9fba47431747360c8242.1645345378.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
Fix the following coccicheck warning:
./drivers/net/wireless/mac80211_hwsim.c:1040:0-23: WARNING:
hwsim_fops_rx_rssi should be defined with
DEFINE_DEBUGFS_ATTRIBUTE
Signed-off-by: Yihao Han <hanyihao@vivo.com>
Link: https://lore.kernel.org/r/20220218070228.6210-1-hanyihao@vivo.com
[fix indentation]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
ath.git patches for v5.18. Major changes:
ath6kl
* add device ID for WLU5150-D81
|
|
iwlwifi patches for v5.18
* Mostly debugging infra changes;
* Some more work on the Bz family of devices;
* Bump the FW API twice;
* Some other small fixes, clean-ups and improvements.
|
|
Add a struct to access logic efuse map, and fill data according to the map.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-14-pkshih@realtek.com
|
|
Read phycap data programmed in efuse, and store them into array.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-13-pkshih@realtek.com
|
|
DAV is an another efuse region that new chip, like 8852C, has this region.
Extend the code to read it, and convert the physical map to logical map
followed by original logical map.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-12-pkshih@realtek.com
|
|
These tables are used to configure hardware buffer size according to
operating mode.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-11-pkshih@realtek.com
|
|
These registers are used to configure and access page size of HCI.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-10-pkshih@realtek.com
|
|
This is a register-based H2C/C2H interface to exchange data with firmware.
Since the register addresses of 8852A and 8852C are different, add fields
to chip_info to support this.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-9-pkshih@realtek.com
|
|
The HCI_FUNC_EN address of 8852C is different from existing chipset, so
add a chip_info::hci_func_en_addr to fill the address individually.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-8-pkshih@realtek.com
|
|
New chipset uses individual power_{on/off} functions to replace old power
sequences, because it is hard to represent new complicated flow in a
sequence table.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-7-pkshih@realtek.com
|
|
Only 8852A may get wrong chip version if power isn't on, so it needs
additional actions to correct the version. Later chips don't need those.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-6-pkshih@realtek.com
|
|
We have had a struct rtw89_pci_ch_dma_addr to describe register address,
so use it as regular. Since the addresses should be changed dynamically
according to operating mode, I don't change it to be constant.
These changes don't affect the logic, so I put them in this separated
patch.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-5-pkshih@realtek.com
|
|
8852CE use V1 address, and flow is totally shared with 8852AE.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-4-pkshih@realtek.com
|
|
Use this struct to implement chip::ops related to PCI interface.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-3-pkshih@realtek.com
|
|
Add these files, and then I can add specific chip::ops or chip::info along
with the existing chip.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307060457.56789-2-pkshih@realtek.com
|
|
Specify devicetree bindings entry for mt76 driver.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/8cbfeceef642ede408b4922c363953cb243cd87f.1646766851.git.lorenzo@kernel.org
|
|
Don't populate the read-only array pktflags on the stack but
instead make it static const. Also makes the object code a little
smaller.
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220307223227.165963-1-colin.i.king@gmail.com
|
|
This function exists in phy_common.c as '_rtl92c_phy_set_rf_sleep'.
Switch to the one in common file.
Signed-off-by: Lu Jicong <jiconglu58@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220306090846.28523-1-jiconglu58@gmail.com
|
|
There are two identical assignments of chip->owner to the same value,
the second assignment is redundant and can be removed.
Cleans up cppcheck warning:
drivers/bcma/driver_gpio.c:184:15: style: Variable 'chip->owner' is
reassigned a value before the old one has been used. [redundantAssignment]
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220303085841.1124766-1-colin.i.king@gmail.com
|
|
Use the helper function time_is_{before,after}_jiffies() to improve
code readability.
Signed-off-by: Wang Qing <wangqing@vivo.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/1646018060-61275-1-git-send-email-wangqing@vivo.com
|
|
These email addresses no longer work, so remove them from MAINTAINERS.
Signed-off-by: Double Lo <Double.Lo@infineon.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220222015947.169224-1-double.lo@infineon.com
|
|
driver keeps the same survey_info struct for its lifetime around.
This is used because while firmware does help by providing accounting
information of the current channel, it doesn't keep track on the
remaining channels.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/9b9a059b384f49587f4384ba47f01d3fb2115b22.1646250537.git.chunkeey@gmail.com
|
|
the mem_bitmap is kept around for the lifetime of the
driver device. This is a perfect candidate for devm.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/0a79221aa5477501c3def032e95ef8018973a514.1646250537.git.chunkeey@gmail.com
|
|
devres will take care of freeing the input_device once
it is no longer needed.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/f81a6ff3b02116c6a448c42eecb546ea5d46c108.1646250537.git.chunkeey@gmail.com
|
|
devres will take care of freeing the hwrng once it is no longer needed.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/d1c16490462a9371ab3cc16a018ef5e08382a35e.1646250537.git.chunkeey@gmail.com
|
|
Since ~2010, the driver is allowed to sleep in the ampdu_action
callback thanks to:
commit 85ad181ea788 ("mac80211: allow drivers to sleep in ampdu_action")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/0036538d0933626a1a5eb2c2c3935cf173028926.1646250537.git.chunkeey@gmail.com
|
|
The device_node pointer is returned by of_parse_phandle() with refcount
incremented. We should use of_node_put() on it when done.
This function only calls of_node_put() in the regular path.
And it will cause refcount leak in error path.
Fixes: 727fec790ead ("ath10k: Setup the msa resources before qmi init")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220308070238.19295-1-linmq006@gmail.com
|
|
All work currently pending will be done first by calling destroy_workqueue,
so there is no need to flush it explicitly.
Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: Lv Ruyi (CGEL ZTE) <lv.ruyi@zte.com.cn>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220301013246.2052570-1-lv.ruyi@zte.com.cn
|
|
This device with a male Mini-B USB connector is part of Panasonic TVs.
Signed-off-by: André Apitzsch <git@apitzsch.eu>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220302211436.8746-1-git@apitzsch.eu
|
|
Start supporting API version 72 for AX devices.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.8de72a8ea67f.I66681363afeb34c619379a5989090264fe6b5f2a@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Move the ppag code to fw/acpi to keep consistency
with the other ACPI handling we do.
Signed-off-by: Matt Chen <matt.chen@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.7f250088b443.I61e64c2758ad178da729ce00428287cc94430eed@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Without trigger data set, no point in any collection.
so check that we have the info for collecting the data.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.5fb34fb1f0eb.I4d7f2a4d162e80474540c5caf1194ed7d32977bc@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Today in the code we have two options for collecting data sync/schedule,
the two options call the same function and can lead to racing in free
resources after done.
So we call only one of two sync/schedule, and in case of sync only
call sync function without also schedule to immediately run as a side
job.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.88574097ce1b.I1b42297619d638d677a2300ed9a95105c1262101@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
There's a hardware bug in Bz A-step that can be worked
around by using 4k queue size, so do that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.10ea0e115d05.Idfb3706133bf3b15f1f68f1145e77e89947449d1@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
We need to also update the IVAR location, since we've shifted
the bit.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Fixes: 571836a02c7b ("iwlwifi: pcie: update sw error interrupt for BZ family")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.bcfb28484e50.I921df6b5134785d7eeb0c934e4a43157c582fa79@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Support debug collection of the platform IMR memory region
only for HW and FW error. This region needs to be collected
as the last region.
Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.5b70e5ba9a41.I502f9b6179b97b163992729edd2b3c5c4ca9e311@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Driver needs to enable IMR which is needed for debug on
certain platforms, so add a device config flag to set it.
Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.0b96b2760503.I08bc741c8c497a2edbe4784cdab6abd8d04c62f3@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Disable IMR region if it is enabled in the TLVs,
but disabled at runtime by the FW.
Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.2a696656a161.I99705472a8838121ffaca72977015dc2069549b9@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
There are no shipping firmware versions with this, and there
will also not be in the future, so remove the support.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.8b3c8b4adf41.Ib3ddb6b250ea2dd72b4ecc88bdd5cffb86af1dcc@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
The module param "enable_ini" is currently used to be enable/disable ini.
Add the option to configure the FW debug preset via this module param,
by change it type from boolean to an integer.
Signed-off-by: Ayala Barazani <ayala.barazani@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.4929e4b14956.I1bdffa4c37d4ee349aa0001978b716b96e38b090@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Add a flags bitfield in REDUCED_TX_POWER_CMD, and
send it as is to FW.
Signed-off-by: Ayala Barazani <ayala.barazani@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.55c2f014f5ee.Iceb632f620de959800f979e212f0dc20240f9d38@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Start supporting API version 71 for AX devices.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220304131517.d0898482506f.I2de2f9140c23f39a837f68199bbaf15a20f26abb@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
|
Don't populate the read-only array voice_priority on the stack but
instead make it static const. Also makes the object code a little
smaller.
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220222121749.87513-1-colin.i.king@gmail.com
|
|
Replace one-element array with flexible-array member in struct
wmi_aplist_event.
Also, make use of the struct_size() helper and remove unneeded variable
ap_info_entry_size.
This issue was found with the help of Coccinelle and audited and fixed,
manually.
Link: https://www.kernel.org/doc/html/v5.16/process/deprecated.html#zero-length-and-one-element-arrays
Link: https://github.com/KSPP/linux/issues/79
Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/1b7889828f23763c034c1558cbab9c8e2066053e.1645736204.git.gustavoars@kernel.org
|
|
Replace one-element array with flexible-array member in struct
wmi_disconnect_event.
This issue was found with the help of Coccinelle and audited and fixed,
manually.
Link: https://www.kernel.org/doc/html/v5.16/process/deprecated.html#zero-length-and-one-element-arrays
Link: https://github.com/KSPP/linux/issues/79
Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/e9957dc53ae48c2f39ae57b0157a67d844b5bc20.1645736204.git.gustavoars@kernel.org
|