mac80211: Update to version 4.19.112
The removed patches are all integrated in the upstream version now. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>v19.07.3_mercusys_ac12_duma
Hauke Mehrtens
4 years ago
parent
794fd4c6cf
commit
c6c3f6bb0a
@ -1,101 +0,0 @@
|
||||
From aaf6a5e86e36766abbeedf220462bde8031f9a72 Mon Sep 17 00:00:00 2001
|
||||
From: Arend van Spriel <arend.vanspriel@broadcom.com>
|
||||
Date: Thu, 14 Feb 2019 13:43:49 +0100
|
||||
Subject: [PATCH] brcmfmac: create debugfs files for bus-specific layer
|
||||
|
||||
Since we moved the drivers debugfs directory under ieee80211 debugfs the
|
||||
debugfs entries need to be added after wiphy_register() has been called.
|
||||
For most part that has been done accordingly, but for the debugfs entries
|
||||
added by SDIO it was not and failed silently. This patch fixes that by
|
||||
adding a bus-layer callback for it.
|
||||
|
||||
Fixes: 856d5a011c86 ("brcmfmac: allocate struct brcmf_pub instance using wiphy_new()")
|
||||
Reported-by: Russel King <linux@armlinux.org.uk>
|
||||
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
|
||||
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
|
||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||||
---
|
||||
.../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 10 ++++++++++
|
||||
.../net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 +
|
||||
.../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 12 +++++++-----
|
||||
3 files changed, 18 insertions(+), 5 deletions(-)
|
||||
|
||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
|
||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
|
||||
@@ -90,6 +90,7 @@ struct brcmf_bus_ops {
|
||||
int (*get_memdump)(struct device *dev, void *data, size_t len);
|
||||
int (*get_fwname)(struct device *dev, const char *ext,
|
||||
unsigned char *fw_name);
|
||||
+ void (*debugfs_create)(struct device *dev);
|
||||
};
|
||||
|
||||
|
||||
@@ -235,6 +236,15 @@ int brcmf_bus_get_fwname(struct brcmf_bu
|
||||
return bus->ops->get_fwname(bus->dev, ext, fw_name);
|
||||
}
|
||||
|
||||
+static inline
|
||||
+void brcmf_bus_debugfs_create(struct brcmf_bus *bus)
|
||||
+{
|
||||
+ if (!bus->ops->debugfs_create)
|
||||
+ return;
|
||||
+
|
||||
+ return bus->ops->debugfs_create(bus->dev);
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* interface functions from common layer
|
||||
*/
|
||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
|
||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
|
||||
@@ -1181,6 +1181,7 @@ static int brcmf_bus_started(struct brcm
|
||||
brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
|
||||
brcmf_feat_debugfs_create(drvr);
|
||||
brcmf_proto_debugfs_create(drvr);
|
||||
+ brcmf_bus_debugfs_create(bus_if);
|
||||
|
||||
return 0;
|
||||
|
||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
|
||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
|
||||
@@ -3154,9 +3154,12 @@ static int brcmf_debugfs_sdio_count_read
|
||||
return 0;
|
||||
}
|
||||
|
||||
-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
|
||||
+static void brcmf_sdio_debugfs_create(struct device *dev)
|
||||
{
|
||||
- struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
|
||||
+ struct brcmf_bus *bus_if = dev_get_drvdata(dev);
|
||||
+ struct brcmf_pub *drvr = bus_if->drvr;
|
||||
+ struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
|
||||
+ struct brcmf_sdio *bus = sdiodev->bus;
|
||||
struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
|
||||
|
||||
if (IS_ERR_OR_NULL(dentry))
|
||||
@@ -3176,7 +3179,7 @@ static int brcmf_sdio_checkdied(struct b
|
||||
return 0;
|
||||
}
|
||||
|
||||
-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
|
||||
+static void brcmf_sdio_debugfs_create(struct device *dev)
|
||||
{
|
||||
}
|
||||
#endif /* DEBUG */
|
||||
@@ -3488,8 +3491,6 @@ static int brcmf_sdio_bus_preinit(struct
|
||||
if (bus->rxbuf)
|
||||
bus->rxblen = value;
|
||||
|
||||
- brcmf_sdio_debugfs_create(bus);
|
||||
-
|
||||
/* the commands below use the terms tx and rx from
|
||||
* a device perspective, ie. bus:txglom affects the
|
||||
* bus transfers from device to host.
|
||||
@@ -4099,6 +4100,7 @@ static const struct brcmf_bus_ops brcmf_
|
||||
.get_ramsize = brcmf_sdio_bus_get_ramsize,
|
||||
.get_memdump = brcmf_sdio_bus_get_memdump,
|
||||
.get_fwname = brcmf_sdio_get_fwname,
|
||||
+ .debugfs_create = brcmf_sdio_debugfs_create
|
||||
};
|
||||
|
||||
#define BRCMF_SDIO_FW_CODE 0
|
||||
@ -1,41 +0,0 @@
|
||||
From a927e8d8ab57e696800e20cf09a72b7dfe3bbebb Mon Sep 17 00:00:00 2001
|
||||
From: Colin Ian King <colin.king@canonical.com>
|
||||
Date: Tue, 9 Apr 2019 12:43:33 +0100
|
||||
Subject: [PATCH] brcmfmac: fix leak of mypkt on error return path
|
||||
|
||||
Currently if the call to brcmf_sdiod_set_backplane_window fails then
|
||||
error return path leaks mypkt. Fix this by returning by a new
|
||||
error path labelled 'out' that calls brcmu_pkt_buf_free_skb to free
|
||||
mypkt. Also remove redundant check on err before calling
|
||||
brcmf_sdiod_skbuff_write.
|
||||
|
||||
Addresses-Coverity: ("Resource Leak")
|
||||
Fixes: a7c3aa1509e2 ("brcmfmac: Remove brcmf_sdiod_addrprep()")
|
||||
Signed-off-by: Colin Ian King <colin.king@canonical.com>
|
||||
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
|
||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||||
---
|
||||
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 +++-----
|
||||
1 file changed, 3 insertions(+), 5 deletions(-)
|
||||
|
||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
|
||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
|
||||
@@ -617,15 +617,13 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
|
||||
|
||||
err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
|
||||
if (err)
|
||||
- return err;
|
||||
+ goto out;
|
||||
|
||||
addr &= SBSDIO_SB_OFT_ADDR_MASK;
|
||||
addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
|
||||
|
||||
- if (!err)
|
||||
- err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
|
||||
- mypkt);
|
||||
-
|
||||
+ err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr, mypkt);
|
||||
+out:
|
||||
brcmu_pkt_buf_free_skb(mypkt);
|
||||
|
||||
return err;
|
||||
@ -1,31 +0,0 @@
|
||||
From 216b44000ada87a63891a8214c347e05a4aea8fe Mon Sep 17 00:00:00 2001
|
||||
From: Dan Carpenter <dan.carpenter@oracle.com>
|
||||
Date: Tue, 3 Dec 2019 12:58:55 +0300
|
||||
Subject: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes()
|
||||
|
||||
The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
|
||||
static checker warning:
|
||||
|
||||
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
|
||||
error: dereferencing freed memory 'pkt'
|
||||
|
||||
It looks like there was supposed to be a continue after we free "pkt".
|
||||
|
||||
Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
|
||||
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
|
||||
Acked-by: Franky Lin <franky.lin@broadcom.com>
|
||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||||
---
|
||||
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
|
||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
|
||||
@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct
|
||||
BRCMF_SDIO_FT_NORMAL)) {
|
||||
rd->len = 0;
|
||||
brcmu_pkt_buf_free_skb(pkt);
|
||||
+ continue;
|
||||
}
|
||||
bus->sdcnt.rx_readahead_cnt++;
|
||||
if (rd->len != roundup(rd_new.len, 16)) {
|
||||
@ -1,40 +0,0 @@
|
||||
From 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 Mon Sep 17 00:00:00 2001
|
||||
From: Johan Hovold <johan@kernel.org>
|
||||
Date: Tue, 10 Dec 2019 12:44:22 +0100
|
||||
Subject: [PATCH] brcmfmac: fix interface sanity check
|
||||
|
||||
Make sure to use the current alternate setting when verifying the
|
||||
interface descriptors to avoid binding to an invalid interface.
|
||||
|
||||
Failing to do so could cause the driver to misbehave or trigger a WARN()
|
||||
in usb_submit_urb() that kernels with panic_on_warn set would choke on.
|
||||
|
||||
Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
|
||||
Cc: stable <stable@vger.kernel.org> # 3.4
|
||||
Cc: Arend van Spriel <arend@broadcom.com>
|
||||
Signed-off-by: Johan Hovold <johan@kernel.org>
|
||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||||
---
|
||||
drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
|
||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
|
||||
@@ -1348,7 +1348,7 @@ brcmf_usb_probe(struct usb_interface *in
|
||||
goto fail;
|
||||
}
|
||||
|
||||
- desc = &intf->altsetting[0].desc;
|
||||
+ desc = &intf->cur_altsetting->desc;
|
||||
if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) ||
|
||||
(desc->bInterfaceSubClass != 2) ||
|
||||
(desc->bInterfaceProtocol != 0xff)) {
|
||||
@@ -1361,7 +1361,7 @@ brcmf_usb_probe(struct usb_interface *in
|
||||
|
||||
num_of_eps = desc->bNumEndpoints;
|
||||
for (ep = 0; ep < num_of_eps; ep++) {
|
||||
- endpoint = &intf->altsetting[0].endpoint[ep].desc;
|
||||
+ endpoint = &intf->cur_altsetting->endpoint[ep].desc;
|
||||
endpoint_num = usb_endpoint_num(endpoint);
|
||||
if (!usb_endpoint_xfer_bulk(endpoint))
|
||||
continue;
|
||||
@ -1,26 +0,0 @@
|
||||
From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001
|
||||
From: Navid Emamdoost <navid.emamdoost@gmail.com>
|
||||
Date: Sat, 14 Dec 2019 19:51:14 -0600
|
||||
Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_usbdev_qinit
|
||||
|
||||
In the implementation of brcmf_usbdev_qinit() the allocated memory for
|
||||
reqs is leaking if usb_alloc_urb() fails. Release reqs in the error
|
||||
handling path.
|
||||
|
||||
Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
|
||||
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
|
||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||||
---
|
||||
drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
|
||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
|
||||
@@ -430,6 +430,7 @@ fail:
|
||||
usb_free_urb(req->urb);
|
||||
list_del(q->next);
|
||||
}
|
||||
+ kfree(reqs);
|
||||
return NULL;
|
||||
|
||||
}
|
||||
@ -1,22 +0,0 @@
|
||||
From: Felix Fietkau <nbd@nbd.name>
|
||||
Date: Fri, 14 Jun 2019 21:12:04 +0200
|
||||
Subject: [PATCH] mac80211: minstrel_ht: fix per-group max throughput rate
|
||||
initialization
|
||||
|
||||
The group number needs to be multiplied by the number of rates per group
|
||||
to get the full rate index
|
||||
|
||||
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
---
|
||||
|
||||
--- a/net/mac80211/rc80211_minstrel_ht.c
|
||||
+++ b/net/mac80211/rc80211_minstrel_ht.c
|
||||
@@ -542,7 +542,7 @@ minstrel_ht_update_stats(struct minstrel
|
||||
|
||||
/* (re)Initialize group rate indexes */
|
||||
for(j = 0; j < MAX_THR_RATES; j++)
|
||||
- tmp_group_tp_rate[j] = group;
|
||||
+ tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
|
||||
|
||||
for (i = 0; i < MCS_GROUP_RATES; i++) {
|
||||
if (!(mi->supported[group] & BIT(i)))
|
||||
@ -1,39 +0,0 @@
|
||||
From 95697f9907bfe3eab0ef20265a766b22e27dde64 Mon Sep 17 00:00:00 2001
|
||||
From: Johannes Berg <johannes.berg@intel.com>
|
||||
Date: Fri, 4 Oct 2019 15:37:05 +0300
|
||||
Subject: [PATCH] mac80211: accept deauth frames in IBSS mode
|
||||
|
||||
We can process deauth frames and all, but we drop them very
|
||||
early in the RX path today - this could never have worked.
|
||||
|
||||
Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS")
|
||||
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||||
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
|
||||
Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi
|
||||
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
||||
---
|
||||
net/mac80211/rx.c | 11 ++++++++++-
|
||||
1 file changed, 10 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/net/mac80211/rx.c
|
||||
+++ b/net/mac80211/rx.c
|
||||
@@ -3407,9 +3407,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
|
||||
case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
|
||||
/* process for all: mesh, mlme, ibss */
|
||||
break;
|
||||
+ case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
|
||||
+ if (is_multicast_ether_addr(mgmt->da) &&
|
||||
+ !is_broadcast_ether_addr(mgmt->da))
|
||||
+ return RX_DROP_MONITOR;
|
||||
+
|
||||
+ /* process only for station/IBSS */
|
||||
+ if (sdata->vif.type != NL80211_IFTYPE_STATION &&
|
||||
+ sdata->vif.type != NL80211_IFTYPE_ADHOC)
|
||||
+ return RX_DROP_MONITOR;
|
||||
+ break;
|
||||
case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
|
||||
case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
|
||||
- case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
|
||||
case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
|
||||
if (is_multicast_ether_addr(mgmt->da) &&
|
||||
!is_broadcast_ether_addr(mgmt->da))
|
||||
Loading…
Reference in New Issue