Commit 714ae274 authored by Johannes Berg's avatar Johannes Berg
Browse files

Merge tag 'ath-current-20260505' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath 



Jeff Johnson says:
==================
ath.git update for v7.1-rc3

Fix an ath5k potential stack buffer overwrite.
Fix several issues in ath12k:
- WMI buffer leaks on error conditions
- use of uninitialized stack data when processing RSSI events
- incorrect logic for determining the peer ID in the RX path
==================

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parents 4a142520 d748603f

drivers/net/wireless/ath/ath12k/dp_rx.c

+1 −1
Original line number Diff line number Diff line
@@ -1340,7 +1340,7 @@ void ath12k_dp_rx_deliver_msdu(struct ath12k_pdev_dp *dp_pdev, struct napi_struc 
	bool is_mcbc = rxcb->is_mcbc;

	bool is_eapol = rxcb->is_eapol;



	peer = ath12k_dp_peer_find_by_peerid(dp_pdev, rx_info->peer_id);

	peer = ath12k_dp_peer_find_by_peerid(dp_pdev, rxcb->peer_id);



	pubsta = peer ? peer->sta : NULL;

drivers/net/wireless/ath/ath12k/wmi.c

+89 −16
Original line number Diff line number Diff line
@@ -9778,7 +9778,7 @@ static void 
ath12k_wmi_rssi_dbm_conversion_params_info_event(struct ath12k_base *ab,

						 struct sk_buff *skb)

{

	struct ath12k_wmi_rssi_dbm_conv_info_arg rssi_info;

	struct ath12k_wmi_rssi_dbm_conv_info_arg rssi_info = {};

	struct ath12k *ar;

	s32 noise_floor;

	u32 pdev_id;
@@ -10251,7 +10251,7 @@ int ath12k_wmi_hw_data_filter_cmd(struct ath12k *ar, struct wmi_hw_data_filter_a 
{

	struct wmi_hw_data_filter_cmd *cmd;

	struct sk_buff *skb;

	int len;

	int ret, len;



	len = sizeof(*cmd);

	skb = ath12k_wmi_alloc_skb(ar->wmi->wmi_ab, len);
@@ -10275,7 +10275,13 @@ int ath12k_wmi_hw_data_filter_cmd(struct ath12k *ar, struct wmi_hw_data_filter_a 
		   "wmi hw data filter enable %d filter_bitmap 0x%x\n",

		   arg->enable, arg->hw_filter_bitmap);



	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_HW_DATA_FILTER_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_HW_DATA_FILTER_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_HW_DATA_FILTER_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_wow_host_wakeup_ind(struct ath12k *ar)
@@ -10283,6 +10289,7 @@ int ath12k_wmi_wow_host_wakeup_ind(struct ath12k *ar) 
	struct wmi_wow_host_wakeup_cmd *cmd;

	struct sk_buff *skb;

	size_t len;

	int ret;



	len = sizeof(*cmd);

	skb = ath12k_wmi_alloc_skb(ar->wmi->wmi_ab, len);
@@ -10295,14 +10302,20 @@ int ath12k_wmi_wow_host_wakeup_ind(struct ath12k *ar) 


	ath12k_dbg(ar->ab, ATH12K_DBG_WMI, "wmi tlv wow host wakeup ind\n");



	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_wow_enable(struct ath12k *ar)

{

	struct wmi_wow_enable_cmd *cmd;

	struct sk_buff *skb;

	int len;

	int ret, len;



	len = sizeof(*cmd);

	skb = ath12k_wmi_alloc_skb(ar->wmi->wmi_ab, len);
@@ -10317,7 +10330,13 @@ int ath12k_wmi_wow_enable(struct ath12k *ar) 
	cmd->pause_iface_config = cpu_to_le32(WOW_IFACE_PAUSE_ENABLED);

	ath12k_dbg(ar->ab, ATH12K_DBG_WMI, "wmi tlv wow enable\n");



	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_ENABLE_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_ENABLE_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_WOW_ENABLE_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_wow_add_wakeup_event(struct ath12k *ar, u32 vdev_id,
@@ -10327,6 +10346,7 @@ int ath12k_wmi_wow_add_wakeup_event(struct ath12k *ar, u32 vdev_id, 
	struct wmi_wow_add_del_event_cmd *cmd;

	struct sk_buff *skb;

	size_t len;

	int ret;



	len = sizeof(*cmd);

	skb = ath12k_wmi_alloc_skb(ar->wmi->wmi_ab, len);
@@ -10343,7 +10363,13 @@ int ath12k_wmi_wow_add_wakeup_event(struct ath12k *ar, u32 vdev_id, 
	ath12k_dbg(ar->ab, ATH12K_DBG_WMI, "wmi tlv wow add wakeup event %s enable %d vdev_id %d\n",

		   wow_wakeup_event(event), enable, vdev_id);



	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_wow_add_pattern(struct ath12k *ar, u32 vdev_id, u32 pattern_id,
@@ -10356,6 +10382,7 @@ int ath12k_wmi_wow_add_pattern(struct ath12k *ar, u32 vdev_id, u32 pattern_id, 
	struct sk_buff *skb;

	void *ptr;

	size_t len;

	int ret;



	len = sizeof(*cmd) +

	      sizeof(*tlv) +			/* array struct */
@@ -10435,7 +10462,13 @@ int ath12k_wmi_wow_add_pattern(struct ath12k *ar, u32 vdev_id, u32 pattern_id, 
	ath12k_dbg_dump(ar->ab, ATH12K_DBG_WMI, NULL, "wow bitmask: ",

			bitmap->bitmaskbuf, pattern_len);



	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_ADD_WAKE_PATTERN_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_ADD_WAKE_PATTERN_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_WOW_ADD_WAKE_PATTERN_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_wow_del_pattern(struct ath12k *ar, u32 vdev_id, u32 pattern_id)
@@ -10443,6 +10476,7 @@ int ath12k_wmi_wow_del_pattern(struct ath12k *ar, u32 vdev_id, u32 pattern_id) 
	struct wmi_wow_del_pattern_cmd *cmd;

	struct sk_buff *skb;

	size_t len;

	int ret;



	len = sizeof(*cmd);

	skb = ath12k_wmi_alloc_skb(ar->wmi->wmi_ab, len);
@@ -10459,7 +10493,13 @@ int ath12k_wmi_wow_del_pattern(struct ath12k *ar, u32 vdev_id, u32 pattern_id) 
	ath12k_dbg(ar->ab, ATH12K_DBG_WMI, "wmi tlv wow del pattern vdev_id %d pattern_id %d\n",

		   vdev_id, pattern_id);



	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_DEL_WAKE_PATTERN_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_WOW_DEL_WAKE_PATTERN_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_WOW_DEL_WAKE_PATTERN_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



static struct sk_buff *
@@ -10595,6 +10635,7 @@ int ath12k_wmi_wow_config_pno(struct ath12k *ar, u32 vdev_id, 
			      struct wmi_pno_scan_req_arg  *pno_scan)

{

	struct sk_buff *skb;

	int ret;



	if (pno_scan->enable)

		skb = ath12k_wmi_op_gen_config_pno_start(ar, vdev_id, pno_scan);
@@ -10604,7 +10645,13 @@ int ath12k_wmi_wow_config_pno(struct ath12k *ar, u32 vdev_id, 
	if (IS_ERR_OR_NULL(skb))

		return -ENOMEM;



	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_NETWORK_LIST_OFFLOAD_CONFIG_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_NETWORK_LIST_OFFLOAD_CONFIG_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_NETWORK_LIST_OFFLOAD_CONFIG_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



static void ath12k_wmi_fill_ns_offload(struct ath12k *ar,
@@ -10717,6 +10764,7 @@ int ath12k_wmi_arp_ns_offload(struct ath12k *ar, 
	void *buf_ptr;

	size_t len;

	u8 ns_cnt, ns_ext_tuples = 0;

	int ret;



	ns_cnt = offload->ipv6_count;
@@ -10752,7 +10800,13 @@ int ath12k_wmi_arp_ns_offload(struct ath12k *ar, 
	if (ns_ext_tuples)

		ath12k_wmi_fill_ns_offload(ar, offload, &buf_ptr, enable, 1);



	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_SET_ARP_NS_OFFLOAD_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_SET_ARP_NS_OFFLOAD_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_SET_ARP_NS_OFFLOAD_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_gtk_rekey_offload(struct ath12k *ar,
@@ -10762,7 +10816,7 @@ int ath12k_wmi_gtk_rekey_offload(struct ath12k *ar, 
	struct wmi_gtk_rekey_offload_cmd *cmd;

	struct sk_buff *skb;

	__le64 replay_ctr;

	int len;

	int ret, len;



	len = sizeof(*cmd);

	skb =  ath12k_wmi_alloc_skb(ar->wmi->wmi_ab, len);
@@ -10789,7 +10843,13 @@ int ath12k_wmi_gtk_rekey_offload(struct ath12k *ar, 


	ath12k_dbg(ar->ab, ATH12K_DBG_WMI, "offload gtk rekey vdev: %d %d\n",

		   arvif->vdev_id, enable);

	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_GTK_OFFLOAD_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_GTK_OFFLOAD_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_GTK_OFFLOAD_CMDID offload\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_gtk_rekey_getinfo(struct ath12k *ar,
@@ -10797,7 +10857,7 @@ int ath12k_wmi_gtk_rekey_getinfo(struct ath12k *ar, 
{

	struct wmi_gtk_rekey_offload_cmd *cmd;

	struct sk_buff *skb;

	int len;

	int ret, len;



	len = sizeof(*cmd);

	skb =  ath12k_wmi_alloc_skb(ar->wmi->wmi_ab, len);
@@ -10811,7 +10871,13 @@ int ath12k_wmi_gtk_rekey_getinfo(struct ath12k *ar, 


	ath12k_dbg(ar->ab, ATH12K_DBG_WMI, "get gtk rekey vdev_id: %d\n",

		   arvif->vdev_id);

	return ath12k_wmi_cmd_send(ar->wmi, skb, WMI_GTK_OFFLOAD_CMDID);

	ret = ath12k_wmi_cmd_send(ar->wmi, skb, WMI_GTK_OFFLOAD_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_GTK_OFFLOAD_CMDID getinfo\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_sta_keepalive(struct ath12k *ar,
@@ -10822,6 +10888,7 @@ int ath12k_wmi_sta_keepalive(struct ath12k *ar, 
	struct wmi_sta_keepalive_cmd *cmd;

	struct sk_buff *skb;

	size_t len;

	int ret;



	len = sizeof(*cmd) + sizeof(*arp);

	skb = ath12k_wmi_alloc_skb(wmi->wmi_ab, len);
@@ -10849,7 +10916,13 @@ int ath12k_wmi_sta_keepalive(struct ath12k *ar, 
		   "wmi sta keepalive vdev %d enabled %d method %d interval %d\n",

		   arg->vdev_id, arg->enabled, arg->method, arg->interval);



	return ath12k_wmi_cmd_send(wmi, skb, WMI_STA_KEEPALIVE_CMDID);

	ret = ath12k_wmi_cmd_send(wmi, skb, WMI_STA_KEEPALIVE_CMDID);

	if (ret) {

		ath12k_warn(ar->ab, "failed to send WMI_STA_KEEPALIVE_CMDID\n");

		dev_kfree_skb(skb);

	}



	return ret;

}



int ath12k_wmi_mlo_setup(struct ath12k *ar, struct wmi_mlo_setup_arg *mlo_params)

drivers/net/wireless/ath/ath5k/base.c

+2 −1
Original line number Diff line number Diff line
@@ -1738,6 +1738,7 @@ ath5k_tx_frame_completed(struct ath5k_hw *ah, struct sk_buff *skb, 
	}



	info->status.rates[ts->ts_final_idx].count = ts->ts_final_retry;

	if (ts->ts_final_idx + 1 < IEEE80211_TX_MAX_RATES)

		info->status.rates[ts->ts_final_idx + 1].idx = -1;



	if (unlikely(ts->ts_status)) {