linux-stable.git/drivers/net/wireless/broadcom, branch v4.13.2

brcmfmac: feature check for multi-scheduled scan fails on bcm4345 devices

2017-09-13T21:20:53+00:00

commit f957dd3c8db2781c8a334b166800788feb618625 upstream.

The firmware feature check introduced for multi-scheduled scan is also
failing for bcm4345 devices resulting in a firmware crash.
The reason for this crash has not yet been root cause so this patch avoids
the feature check for those device as a short-term fix.

Fixes: 9fe929aaace6 ("brcmfmac: add firmware feature detection for gscan feature")
Signed-off-by: Ian W MORRISON 
Acked-by: Arend van Spriel 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

brcmfmac: feature check for multi-scheduled scan fails on bcm4343x devices

2017-08-14T08:09:30+00:00

The firmware feature check introduced for multi-scheduled scan turned out
to be failing for bcm4343{0,1,8} devices resulting in a firmware crash.
The reason for this crash has not yet been root cause so this patch avoids
the feature check for those device as a short-term fix.

Reported-by: Stefan Wahren 
Reported-by: Ian Molton 
Fixes: 9fe929aaace6 ("brcmfmac: add firmware feature detection for gscan feature")
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo

brcmfmac: fix memleak due to calling brcmf_sdiod_sgtable_alloc() twice

2017-07-27T11:03:14+00:00

Due to a bugfix in wireless tree and the commit mentioned below a merge
was needed which went haywire. So the submitted change resulted in the
function brcmf_sdiod_sgtable_alloc() being called twice during the probe
thus leaking the memory of the first call.

Cc: stable@vger.kernel.org # 4.6.x
Fixes: 4d7928959832 ("brcmfmac: switch to new platform data")
Reported-by: Stefan Wahren 
Tested-by: Stefan Wahren 
Reviewed-by: Hante Meuleman 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo

brcmfmac: Don't grow SKB by negative size

2017-07-27T11:02:16+00:00

The commit to rework the headroom check in start_xmit() now calls
pxskb_expand_head() unconditionally if the header is CoW. Unfortunately,
it does so with the delta between the extant headroom and the header
length, which may be negative if there is already sufficient headroom.

pskb_expand_head() does allow for size being 0, in which case it just
copies, so clamp the header delta to zero.

Opening Chrome (and all my tabs) on a PCIE device was enough to reliably
hit this.

Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
Signed-off-by: Daniel Stone 
Cc: Arend Van Spriel 
Cc: James Hughes 
Cc: Hante Meuleman 
Cc: Pieter-Paul Giesberts 
Cc: Franky Lin 
Tested-by: Hans de Goede 
Signed-off-by: Kalle Valo

brcmfmac: fix regression in brcmf_sdio_txpkt_hdalign()

2017-07-21T07:40:48+00:00

Recent change in brcmf_sdio_txpkt_hdalign() changed the
behavior and now always returns 0. This resulted in a
regression which basically renders the device useless.

Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
Reported-by: S. Gilles 
Tested-by: S. Gilles 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo

brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()

2017-07-12T15:29:56+00:00

The lower level nl80211 code in cfg80211 ensures that "len" is between
25 and NL80211_ATTR_FRAME (2304).  We subtract DOT11_MGMT_HDR_LEN (24) from
"len" so thats's max of 2280.  However, the action_frame->data[] buffer is
only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy() can
overflow.

	memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
	       le16_to_cpu(action_frame->len));

Cc: stable@vger.kernel.org # 3.9.x
Fixes: 18e2f61db3b70 ("brcmfmac: P2P action frame tx.")
Reported-by: "freenerguo(郭大兴)" 
Signed-off-by: Arend van Spriel 
Signed-off-by: David S. Miller

brcmfmac: switch to using cfg80211_connect_done()

2017-06-30T06:38:22+00:00

The driver used cfg80211_connect_result() which is basically a wrapper
around cfg80211_connect_done() passing a subset of the information that
can be passed. For upcoming functionality this is not sufficient so
switching to use cfg80211_connect_done().

Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo

brcmfmac: support 4-way handshake offloading for 802.1X

2017-06-30T06:38:22+00:00

Adding callbacks for PMK provisioning. If firmware supports offloading
it is indicated to user-space that 802.1X offload is supported.

Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo

brcmfmac: support 4-way handshake offloading for WPA/WPA2-PSK

2017-06-30T06:38:22+00:00

The firmware may have supplicant code built-in. This is detected
by the driver and indicated in the wiphy features flags. User-space
can use this flag to determine whether or not to provide the
pre-shared key material in the nl80211 CONNECT command.

Reviewed-by: Gautam (Gautam Kumar) Shukla 
Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo

brcmfmac: rework headroom check in .start_xmit()

2017-06-28T17:53:06+00:00

Since commit 9cc4b7cb86cb ("brcmfmac: Make skb header writable
before use") the headroom usage has been fixed. However, the
driver was keeping statistics that got lost. So reworking the
code so we get those driver statistics back for debugging.

Cc: James Hughes 
Reviewed-by: Hante Meuleman 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Franky Lin 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo