kernel.git/drivers/net/wireless/marvell, branch linux-5.9.y

mwifiex: don't call del_timer_sync() on uninitialized timer

2020-10-29T09:12:19Z

[ Upstream commit 621a3a8b1c0ecf16e1e5667ea5756a76a082b738 ] syzbot is reporting that del_timer_sync() is called from mwifiex_usb_cleanup_tx_aggr() from mwifiex_unregister_dev() without checking timer_setup() from mwifiex_usb_tx_init() was called [1]. Ganapathi Bhat proposed a possibly cleaner fix, but it seems that that fix was forgotten [2]. "grep -FrB1 'del_timer' drivers/ | grep -FA1 '.function)'" says that currently there are 28 locations which call del_timer[_sync]() only if that timer's function field was initialized (because timer_setup() sets that timer's function field). Therefore, let's use same approach here. [1] https://syzkaller.appspot.com/bug?id=26525f643f454dd7be0078423e3cdb0d57744959 [2] https://lkml.kernel.org/r/CA+ASDXMHt2gq9Hy+iP_BYkWXsSreWdp3_bAfMkNcuqJ3K+-jbQ@mail.gmail.com Reported-by: syzbot Cc: Ganapathi Bhat Cc: Brian Norris Signed-off-by: Tetsuo Handa Reviewed-by: Brian Norris Acked-by: Ganapathi Bhat Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200821082720.7716-1-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Sasha Levin

mwifiex: fix double free

2020-10-29T09:11:35Z

[ Upstream commit 53708f4fd9cfe389beab5c8daa763bcd0e0b4aef ] clang static analysis reports this problem: sdio.c:2403:3: warning: Attempt to free released memory kfree(card->mpa_rx.buf); ^~~~~~~~~~~~~~~~~~~~~~~ When mwifiex_init_sdio() fails in its first call to mwifiex_alloc_sdio_mpa_buffer, it falls back to calling it again. If the second alloc of mpa_tx.buf fails, the error handler will try to free the old, previously freed mpa_rx.buf. Reviewing the code, it looks like a second double free would happen with mwifiex_cleanup_sdio(). So set both pointers to NULL when they are freed. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Tom Rix Reviewed-by: Brian Norris Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20201004131931.29782-1-trix@redhat.com Signed-off-by: Sasha Levin

mwifiex: Do not use GFP_KERNEL in atomic context

2020-10-29T09:11:13Z

[ Upstream commit d2ab7f00f4321370a8ee14e5630d4349fdacc42e ] A possible call chain is as follow: mwifiex_sdio_interrupt (sdio.c) --> mwifiex_main_process (main.c) --> mwifiex_process_cmdresp (cmdevt.c) --> mwifiex_process_sta_cmdresp (sta_cmdresp.c) --> mwifiex_ret_802_11_scan (scan.c) --> mwifiex_parse_single_response_buf (scan.c) 'mwifiex_sdio_interrupt()' is an interrupt function. Also note that 'mwifiex_ret_802_11_scan()' already uses GFP_ATOMIC. So use GFP_ATOMIC instead of GFP_KERNEL when memory is allocated in 'mwifiex_parse_single_response_buf()'. Fixes: 7c6fa2a843c5 ("mwifiex: use cfg80211 dynamic scan table and cfg80211_get_bss API") or Fixes: 601216e12c65e ("mwifiex: process RX packets in SDIO IRQ thread directly") Signed-off-by: Christophe JAILLET Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200809092906.744621-1-christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin

mwifiex: Increase AES key storage size to 256 bits

2020-08-27T13:16:04Z

Following commit e18696786548 ("mwifiex: Prevent memory corruption handling keys") the mwifiex driver fails to authenticate with certain networks, specifically networks with 256 bit keys, and repeatedly asks for the password. The kernel log repeats the following lines (id and bssid redacted): mwifiex_pcie 0000:01:00.0: info: trying to associate to '' bssid mwifiex_pcie 0000:01:00.0: info: associated to bssid successfully mwifiex_pcie 0000:01:00.0: crypto keys added mwifiex_pcie 0000:01:00.0: info: successfully disconnected from : reason code 3 Tracking down this problem lead to the overflow check introduced by the aforementioned commit into mwifiex_ret_802_11_key_material_v2(). This check fails on networks with 256 bit keys due to the current storage size for AES keys in struct mwifiex_aes_param being only 128 bit. To fix this issue, increase the storage size for AES keys to 256 bit. Fixes: e18696786548 ("mwifiex: Prevent memory corruption handling keys") Signed-off-by: Maximilian Luz Reported-by: Kaloyan Nikolov Tested-by: Kaloyan Nikolov Reviewed-by: Dan Carpenter Reviewed-by: Brian Norris Tested-by: Brian Norris Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200825153829.38043-1-luzmaximilian@gmail.com

Merge tag 'wireless-drivers-next-2020-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

2020-08-04T19:57:02Z

Kalle Valo says: ==================== wireless-drivers-next patches for v5.9 Second set of patches for v5.9. mt76 has most of patches this time. Otherwise it's just smaller fixes and cleanups to other drivers. There was a major conflict in mt76 driver between wireless-drivers and wireless-drivers-next. I solved that by merging the former to the latter. Major changes: rtw88 * add support for ieee80211_ops::change_interface * add support for enabling and disabling beacon * add debugfs file for testing h2c mt76 * ARP filter offload for 7663 * runtime power management for 7663 * testmode support for mfg calibration * support for more channels ==================== Signed-off-by: David S. Miller

mwifiex: 11n_rxreorder: Remove unnecessary cast in kfree()

2020-08-02T14:56:09Z

Remove unnecassary casts in the argument to kfree. Signed-off-by: Xu Wang Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200727020405.8476-1-vulab@iscas.ac.cn

Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next

2020-07-31T22:11:52Z

Johan Hedberg says: ==================== pull request: bluetooth-next 2020-07-31 Here's the main bluetooth-next pull request for 5.9: - Fix firmware filenames for Marvell chipsets - Several suspend-related fixes - Addedd mgmt commands for runtime configuration - Multiple fixes for Qualcomm-based controllers - Add new monitoring feature for mgmt - Fix handling of legacy cipher (E4) together with security level 4 - Add support for Realtek 8822CE controller - Fix issues with Chinese controllers using fake VID/PID values - Multiple other smaller fixes & improvements ==================== Signed-off-by: David S. Miller

mwifiex: Prevent memory corruption handling keys

2020-07-15T09:13:30Z

The length of the key comes from the network and it's a 16 bit number. It needs to be capped to prevent a buffer overflow. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Dan Carpenter Acked-by: Ganapathi Bhat Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200708115857.GA13729@mwanda

mwifiex: Fix reporting 'operation not supported' error code

2020-07-15T09:13:04Z

ENOTSUPP (double PP) is internal linux kernel code 524 available only in kernel include file linux/errno.h and not exported to userspace. EOPNOTSUPP (OP; double PP) is standard code 95 for reporting 'operation not supported' available via kernel include file uapi/asm-generic/errno.h. ENOTSUP (single P) is alias for EOPNOTSUPP defined only in userspace include file bits/errno.h and not available in kernel. Because Linux kernel does not support ENOTSUP (single P) and because userspace does not support ENOTSUPP (double PP), report error code for 'operation not supported' via EOPNOTSUPP macro. This patch fixes problem that mwifiex kernel driver sends to userspace unsupported error codes like: "failed: -524 (No error information)". After applying this patch userspace see: "failed: -95 (Not supported)". Signed-off-by: Pali Rohár Acked-by: Ganapathi Bhat Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200703112151.18917-1-pali@kernel.org

mwifiex: Use macro MWIFIEX_MAX_BSS_NUM for specifying limit of interfaces

2020-07-15T09:12:02Z

This macro is already used in mwifiex driver for specifying upper limit and is defined to value 3. So use it also in struct ieee80211_iface_limit. Signed-off-by: Pali Rohár Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200626152938.12737-1-pali@kernel.org