Skip to content

Commit 040cda8

Browse files
davem330davem330
committed
Merge tag 'wireless-drivers-2019-12-17' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
Kalle Valo says: ==================== wireless-drivers fixes for v5.5 First set of fixes for v5.5. Fixing security issues, some regressions and few major bugs. mwifiex * security fix for handling country Information Elements (CVE-2019-14895) * security fix for handling TDLS Information Elements ath9k * fix endian issue with ath9k_pci_owl_loader mt76 * fix default mac address handling iwlwifi * fix merge damage which lead to firmware crashing during boot on some devices * fix device initialisation regression on some devices ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents daa6eb5 + 0df36b9 commit 040cda8

File tree

7 files changed

+122
-47
lines changed

7 files changed

+122
-47
lines changed

‎drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ static int ath9k_pci_fixup(struct pci_dev *pdev, const u16 *cal_data,
8383
val = swahb32(val);
8484
}
8585

86-
__raw_writel(val, mem + reg);
86+
iowrite32(val, mem + reg);
8787
usleep_range(100, 120);
8888
}
8989

‎drivers/net/wireless/intel/iwlwifi/pcie/drv.c‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1111,18 +1111,18 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
11111111

11121112
/* same thing for QuZ... */
11131113
if (iwl_trans->hw_rev == CSR_HW_REV_TYPE_QUZ) {
1114-
if (iwl_trans->cfg == &iwl_ax101_cfg_qu_hr)
1115-
iwl_trans->cfg = &iwl_ax101_cfg_quz_hr;
1116-
else if (iwl_trans->cfg == &iwl_ax201_cfg_qu_hr)
1117-
iwl_trans->cfg = &iwl_ax201_cfg_quz_hr;
1118-
else if (iwl_trans->cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0)
1119-
iwl_trans->cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc;
1120-
else if (iwl_trans->cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0)
1121-
iwl_trans->cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc;
1122-
else if (iwl_trans->cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0)
1123-
iwl_trans->cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc;
1124-
else if (iwl_trans->cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0)
1125-
iwl_trans->cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc;
1114+
if (cfg == &iwl_ax101_cfg_qu_hr)
1115+
cfg = &iwl_ax101_cfg_quz_hr;
1116+
else if (cfg == &iwl_ax201_cfg_qu_hr)
1117+
cfg = &iwl_ax201_cfg_quz_hr;
1118+
else if (cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0)
1119+
cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc;
1120+
else if (cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0)
1121+
cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc;
1122+
else if (cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0)
1123+
cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc;
1124+
else if (cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0)
1125+
cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc;
11261126
}
11271127

11281128
#endif

‎drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -57,24 +57,6 @@
5757
#include "internal.h"
5858
#include "fw/dbg.h"
5959

60-
static int iwl_pcie_gen2_force_power_gating(struct iwl_trans *trans)
61-
{
62-
iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG,
63-
HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE);
64-
udelay(20);
65-
iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG,
66-
HPM_HIPM_GEN_CFG_CR_PG_EN |
67-
HPM_HIPM_GEN_CFG_CR_SLP_EN);
68-
udelay(20);
69-
iwl_clear_bits_prph(trans, HPM_HIPM_GEN_CFG,
70-
HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE);
71-
72-
iwl_trans_sw_reset(trans);
73-
iwl_clear_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
74-
75-
return 0;
76-
}
77-
7860
/*
7961
* Start up NIC's basic functionality after it has been reset
8062
* (e.g. after platform boot, or shutdown via iwl_pcie_apm_stop())
@@ -110,13 +92,6 @@ int iwl_pcie_gen2_apm_init(struct iwl_trans *trans)
11092

11193
iwl_pcie_apm_config(trans);
11294

113-
if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
114-
trans->cfg->integrated) {
115-
ret = iwl_pcie_gen2_force_power_gating(trans);
116-
if (ret)
117-
return ret;
118-
}
119-
12095
ret = iwl_finish_nic_init(trans, trans->trans_cfg);
12196
if (ret)
12297
return ret;

‎drivers/net/wireless/intel/iwlwifi/pcie/trans.c‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1783,6 +1783,29 @@ static int iwl_trans_pcie_clear_persistence_bit(struct iwl_trans *trans)
17831783
return 0;
17841784
}
17851785

1786+
static int iwl_pcie_gen2_force_power_gating(struct iwl_trans *trans)
1787+
{
1788+
int ret;
1789+
1790+
ret = iwl_finish_nic_init(trans, trans->trans_cfg);
1791+
if (ret < 0)
1792+
return ret;
1793+
1794+
iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG,
1795+
HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE);
1796+
udelay(20);
1797+
iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG,
1798+
HPM_HIPM_GEN_CFG_CR_PG_EN |
1799+
HPM_HIPM_GEN_CFG_CR_SLP_EN);
1800+
udelay(20);
1801+
iwl_clear_bits_prph(trans, HPM_HIPM_GEN_CFG,
1802+
HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE);
1803+
1804+
iwl_trans_pcie_sw_reset(trans);
1805+
1806+
return 0;
1807+
}
1808+
17861809
static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans)
17871810
{
17881811
struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
@@ -1802,6 +1825,13 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans)
18021825

18031826
iwl_trans_pcie_sw_reset(trans);
18041827

1828+
if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
1829+
trans->cfg->integrated) {
1830+
err = iwl_pcie_gen2_force_power_gating(trans);
1831+
if (err)
1832+
return err;
1833+
}
1834+
18051835
err = iwl_pcie_apm_init(trans);
18061836
if (err)
18071837
return err;

‎drivers/net/wireless/marvell/mwifiex/sta_ioctl.c‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
229229
"11D: skip setting domain info in FW\n");
230230
return 0;
231231
}
232+
233+
if (country_ie_len >
234+
(IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
235+
mwifiex_dbg(priv->adapter, ERROR,
236+
"11D: country_ie_len overflow!, deauth AP\n");
237+
return -EINVAL;
238+
}
239+
232240
memcpy(priv->adapter->country_code, &country_ie[2], 2);
233241

234242
domain_info->country_code[0] = country_ie[2];
@@ -272,8 +280,9 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
272280
priv->scan_block = false;
273281

274282
if (bss) {
275-
if (adapter->region_code == 0x00)
276-
mwifiex_process_country_ie(priv, bss);
283+
if (adapter->region_code == 0x00 &&
284+
mwifiex_process_country_ie(priv, bss))
285+
return -EINVAL;
277286

278287
/* Allocate and fill new bss descriptor */
279288
bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),

‎drivers/net/wireless/marvell/mwifiex/tdls.c‎

Lines changed: 64 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -953,59 +953,117 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
953953

954954
switch (*pos) {
955955
case WLAN_EID_SUPP_RATES:
956+
if (pos[1] > 32)
957+
return;
956958
sta_ptr->tdls_cap.rates_len = pos[1];
957959
for (i = 0; i < pos[1]; i++)
958960
sta_ptr->tdls_cap.rates[i] = pos[i + 2];
959961
break;
960962

961963
case WLAN_EID_EXT_SUPP_RATES:
964+
if (pos[1] > 32)
965+
return;
962966
basic = sta_ptr->tdls_cap.rates_len;
967+
if (pos[1] > 32 - basic)
968+
return;
963969
for (i = 0; i < pos[1]; i++)
964970
sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2];
965971
sta_ptr->tdls_cap.rates_len += pos[1];
966972
break;
967973
case WLAN_EID_HT_CAPABILITY:
968-
memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos,
974+
if (pos > end - sizeof(struct ieee80211_ht_cap) - 2)
975+
return;
976+
if (pos[1] != sizeof(struct ieee80211_ht_cap))
977+
return;
978+
/* copy the ie's value into ht_capb*/
979+
memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2,
969980
sizeof(struct ieee80211_ht_cap));
970981
sta_ptr->is_11n_enabled = 1;
971982
break;
972983
case WLAN_EID_HT_OPERATION:
973-
memcpy(&sta_ptr->tdls_cap.ht_oper, pos,
984+
if (pos > end -
985+
sizeof(struct ieee80211_ht_operation) - 2)
986+
return;
987+
if (pos[1] != sizeof(struct ieee80211_ht_operation))
988+
return;
989+
/* copy the ie's value into ht_oper*/
990+
memcpy(&sta_ptr->tdls_cap.ht_oper, pos + 2,
974991
sizeof(struct ieee80211_ht_operation));
975992
break;
976993
case WLAN_EID_BSS_COEX_2040:
994+
if (pos > end - 3)
995+
return;
996+
if (pos[1] != 1)
997+
return;
977998
sta_ptr->tdls_cap.coex_2040 = pos[2];
978999
break;
9791000
case WLAN_EID_EXT_CAPABILITY:
1001+
if (pos > end - sizeof(struct ieee_types_header))
1002+
return;
1003+
if (pos[1] < sizeof(struct ieee_types_header))
1004+
return;
1005+
if (pos[1] > 8)
1006+
return;
9801007
memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos,
9811008
sizeof(struct ieee_types_header) +
9821009
min_t(u8, pos[1], 8));
9831010
break;
9841011
case WLAN_EID_RSN:
1012+
if (pos > end - sizeof(struct ieee_types_header))
1013+
return;
1014+
if (pos[1] < sizeof(struct ieee_types_header))
1015+
return;
1016+
if (pos[1] > IEEE_MAX_IE_SIZE -
1017+
sizeof(struct ieee_types_header))
1018+
return;
9851019
memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos,
9861020
sizeof(struct ieee_types_header) +
9871021
min_t(u8, pos[1], IEEE_MAX_IE_SIZE -
9881022
sizeof(struct ieee_types_header)));
9891023
break;
9901024
case WLAN_EID_QOS_CAPA:
1025+
if (pos > end - 3)
1026+
return;
1027+
if (pos[1] != 1)
1028+
return;
9911029
sta_ptr->tdls_cap.qos_info = pos[2];
9921030
break;
9931031
case WLAN_EID_VHT_OPERATION:
994-
if (priv->adapter->is_hw_11ac_capable)
995-
memcpy(&sta_ptr->tdls_cap.vhtoper, pos,
1032+
if (priv->adapter->is_hw_11ac_capable) {
1033+
if (pos > end -
1034+
sizeof(struct ieee80211_vht_operation) - 2)
1035+
return;
1036+
if (pos[1] !=
1037+
sizeof(struct ieee80211_vht_operation))
1038+
return;
1039+
/* copy the ie's value into vhtoper*/
1040+
memcpy(&sta_ptr->tdls_cap.vhtoper, pos + 2,
9961041
sizeof(struct ieee80211_vht_operation));
1042+
}
9971043
break;
9981044
case WLAN_EID_VHT_CAPABILITY:
9991045
if (priv->adapter->is_hw_11ac_capable) {
1000-
memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos,
1046+
if (pos > end -
1047+
sizeof(struct ieee80211_vht_cap) - 2)
1048+
return;
1049+
if (pos[1] != sizeof(struct ieee80211_vht_cap))
1050+
return;
1051+
/* copy the ie's value into vhtcap*/
1052+
memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2,
10011053
sizeof(struct ieee80211_vht_cap));
10021054
sta_ptr->is_11ac_enabled = 1;
10031055
}
10041056
break;
10051057
case WLAN_EID_AID:
1006-
if (priv->adapter->is_hw_11ac_capable)
1058+
if (priv->adapter->is_hw_11ac_capable) {
1059+
if (pos > end - 4)
1060+
return;
1061+
if (pos[1] != 2)
1062+
return;
10071063
sta_ptr->tdls_cap.aid =
10081064
get_unaligned_le16((pos + 2));
1065+
}
1066+
break;
10091067
default:
10101068
break;
10111069
}

‎drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -342,8 +342,11 @@ int mt76x0_eeprom_init(struct mt76x02_dev *dev)
342342
dev_info(dev->mt76.dev, "EEPROM ver:%02hhx fae:%02hhx\n",
343343
version, fae);
344344

345-
mt76x02_mac_setaddr(dev, dev->mt76.eeprom.data + MT_EE_MAC_ADDR);
345+
memcpy(dev->mt76.macaddr, (u8 *)dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
346+
ETH_ALEN);
346347
mt76_eeprom_override(&dev->mt76);
348+
mt76x02_mac_setaddr(dev, dev->mt76.macaddr);
349+
347350
mt76x0_set_chip_cap(dev);
348351
mt76x0_set_freq_offset(dev);
349352
mt76x0_set_temp_offset(dev);

0 commit comments

Comments
 (0)