kernel.git/drivers/net/wireless/ti/wlcore, branch linux-5.12.y

wlcore: Fix buffer overrun by snprintf due to incorrect buffer size

2021-05-14T08:53:02Z

[ Upstream commit a9a4c080deb33f44e08afe35f4ca4bb9ece89f4e ] The size of the buffer than can be written to is currently incorrect, it is always the size of the entire buffer even though the snprintf is writing as position pos into the buffer. Fix this by setting the buffer size to be the number of bytes left in the buffer, namely sizeof(buf) - pos. Addresses-Coverity: ("Out-of-bounds access") Fixes: 7b0e2c4f6be3 ("wlcore: fix overlapping snprintf arguments in debugfs") Signed-off-by: Colin Ian King Reviewed-by: Arnd Bergmann Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210419141405.180582-1-colin.king@canonical.com Signed-off-by: Sasha Levin

wlcore: fix overlapping snprintf arguments in debugfs

2021-05-14T08:52:58Z

[ Upstream commit 7b0e2c4f6be3ec68bf807c84e985e81c21404cd1 ] gcc complains about undefined behavior in calling snprintf() with the same buffer as input and output: drivers/net/wireless/ti/wl18xx/debugfs.c: In function 'diversity_num_of_packets_per_ant_read': drivers/net/wireless/ti/wl18xx/../wlcore/debugfs.h:86:3: error: 'snprintf' argument 4 overlaps destination object 'buf' [-Werror=restrict] 86 | snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 87 | buf, i, stats->sub.name[i]); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ti/wl18xx/debugfs.c:24:2: note: in expansion of macro 'DEBUGFS_FWSTATS_FILE_ARRAY' 24 | DEBUGFS_FWSTATS_FILE_ARRAY(a, b, c, wl18xx_acx_statistics) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ti/wl18xx/debugfs.c:159:1: note: in expansion of macro 'WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY' 159 | WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(diversity, num_of_packets_per_ant, There are probably other ways of handling the debugfs file, without using on-stack buffers, but a simple workaround here is to remember the current position in the buffer and just keep printing in there. Fixes: bcca1bbdd412 ("wlcore: add debugfs macro to help print fw statistics arrays") Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210323125723.1961432-1-arnd@kernel.org Signed-off-by: Sasha Levin

wlcore: Fix command execute failure 19 for wl12xx

2021-01-25T14:42:12Z

We can currently get a "command execute failure 19" error on beacon loss if the signal is weak: wlcore: Beacon loss detected. roles:0xff wlcore: Connection loss work (role_id: 0). ... wlcore: ERROR command execute failure 19 ... WARNING: CPU: 0 PID: 1552 at drivers/net/wireless/ti/wlcore/main.c:803 ... (wl12xx_queue_recovery_work.part.0 [wlcore]) (wl12xx_cmd_role_start_sta [wlcore]) (wl1271_op_bss_info_changed [wlcore]) (ieee80211_prep_connection [mac80211]) Error 19 is defined as CMD_STATUS_WRONG_NESTING from the wlcore firmware, and seems to mean that the firmware no longer wants to see the quirk handling for WLCORE_QUIRK_START_STA_FAILS done. This quirk got added with commit 18eab430700d ("wlcore: workaround start_sta problem in wl12xx fw"), and it seems that this already got fixed in the firmware long time ago back in 2012 as wl18xx never had this quirk in place to start with. As we no longer even support firmware that early, to me it seems that it's safe to just drop WLCORE_QUIRK_START_STA_FAILS to fix the error. Looks like earlier firmware got disabled back in 2013 with commit 0e284c074ef9 ("wl12xx: increase minimum singlerole firmware version required"). If it turns out we still need WLCORE_QUIRK_START_STA_FAILS with any firmware that the driver works with, we can simply revert this patch and add extra checks for firmware version used. With this fix wlcore reconnects properly after a beacon loss. Cc: Raz Bouganim Signed-off-by: Tony Lindgren Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210115065613.7731-1-tony@atomide.com

wlcore: Downgrade exceeded max RX BA sessions to debug

2021-01-14T17:33:53Z

We can get the following in the logs every few minutes or so: wlcore: ERROR exceeded max RX BA sessions Let's downgrade the message to a debug message as suggested by the TI support folks at: https://e2e.ti.com/support/wireless-connectivity/wifi/f/968/p/352435/1244754 "The WL127x firmware supports max of 3 BA sessions. It cannot be increased. I think the problem here is the peer trying to initiate a 4th BA session (ADDBA request)." Signed-off-by: Tony Lindgren Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210101065955.63386-1-tony@atomide.com

wlcore: Switch to using the new API kobj_to_dev()

2020-12-02T19:25:39Z

Switch to using the new API kobj_to_dev(). Signed-off-by: Tian Tao Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1606096062-32251-1-git-send-email-tiantao6@hisilicon.com

wlcore: spi: Demote a non-compliant function header, fix another

2020-11-07T16:05:38Z

Fixes the following W=1 kernel build warning(s): drivers/net/wireless/ti/wlcore/spi.c:403: warning: Function parameter or member 'child' not described in 'wl12xx_spi_set_block_size' drivers/net/wireless/ti/wlcore/spi.c:403: warning: Function parameter or member 'blksz' not described in 'wl12xx_spi_set_block_size' drivers/net/wireless/ti/wlcore/spi.c:440: warning: Excess function parameter 'res' description in 'wlcore_probe_of' Cc: Kalle Valo Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Geert Uytterhoeven Cc: Luciano Coelho Cc: Juuso Oikarinen Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Lee Jones Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20201102112410.1049272-36-lee.jones@linaro.org Link: https://lore.kernel.org/r/20201102112410.1049272-37-lee.jones@linaro.org

wlcore: Use fallthrough pseudo-keyword

2020-11-07T11:30:54Z

In order to enable -Wimplicit-fallthrough for Clang[1], replace the existing /* fall-through */ comments with the new pseudo-keyword macro fallthrough[2]. [1] https://git.kernel.org/linus/e2079e93f562c7f7a030eb7642017ee5eabaaa10 [2] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20201008220905.GA8040@embeddedor

Merge tag 'wireless-drivers-next-2020-09-25' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

2020-09-25T20:16:29Z

Kalle Valo says: ==================== wireless-drivers-next patches for v5.10 Second set of patches for v5.10. Biggest change here is wcn3680 support to wcn36xx driver, otherwise smaller features. And naturally the usual fixes and cleanups. Major changes: brcmfmac * support 4-way handshake offloading for WPA/WPA2-PSK in AP mode * support SAE authentication offload in AP mode mt76 * mt7663 runtime power management improvements * mt7915 A-MSDU offload wcn36xx * add support wcn3680 Wi-Fi 5 devices ath11k * spectral scan support for ipq6018 ==================== Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2020-09-22T23:45:34Z

Two minor conflicts: 1) net/ipv4/route.c, adding a new local variable while moving another local variable and removing it's initial assignment. 2) drivers/net/dsa/microchip/ksz9477.c, overlapping changes. One pretty prints the port mode differently, whilst another changes the driver to try and obtain the port mode from the port node rather than the switch node. Signed-off-by: David S. Miller

wlcore: Remove unused function no_write_handler()

2020-09-22T07:14:42Z

There is no caller in tree, so can remove it. Signed-off-by: YueHaibing Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200918131305.20976-1-yuehaibing@huawei.com