linux-stable.git/drivers/net/wireless/broadcom, branch v6.6

wifi: brcmfmac: Replace 1-element arrays with flexible arrays

2023-09-18T13:20:21+00:00

Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"),
UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking
'element' and 'channel_list' will trigger warnings, so make them proper
flexible arrays.

False positive warnings were:

  UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6984:20
  index 1 is out of range for type '__le32 [1]'

  UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1126:27
  index 1 is out of range for type '__le16 [1]'

for these lines of code:

  6884  ch.chspec = (u16)le32_to_cpu(list->element[i]);

  1126  params_le->channel_list[i] = cpu_to_le16(chanspec);

Cc: stable@vger.kernel.org # 6.5+
Signed-off-by: Juerg Haefliger 
Reviewed-by: Kees Cook 
Reviewed-by: Gustavo A. R. Silva 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20230914070227.12028-1-juerg.haefliger@canonical.com

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2023-08-10T21:10:53+00:00

Cross-merge networking fixes after downstream PR.

No conflicts.

Adjacent changes:

drivers/net/ethernet/intel/igc/igc_main.c
  06b412589eef ("igc: Add lock to safeguard global Qbv variables")
  d3750076d464 ("igc: Add TransmissionOverrun counter")

drivers/net/ethernet/microsoft/mana/mana_en.c
  a7dfeda6fdec ("net: mana: Fix MANA VF unload when hardware is unresponsive")
  a9ca9f9ceff3 ("page_pool: split types and declarations from page_pool.h")
  92272ec4107e ("eth: add missing xdp.h includes in drivers")

net/mptcp/protocol.h
  511b90e39250 ("mptcp: fix disconnect vs accept race")
  b8dc6d6ce931 ("mptcp: fix rcv buffer auto-tuning")

tools/testing/selftests/net/mptcp/mptcp_join.sh
  c8c101ae390a ("selftests: mptcp: join: fix 'implicit EP' test")
  03668c65d153 ("selftests: mptcp: join: rework detailed report")

Signed-off-by: Jakub Kicinski

wifi: brcm80211: handle params_v1 allocation failure

2023-08-08T10:47:37+00:00

Return -ENOMEM from brcmf_run_escan() if kzalloc() fails for v1 params.

Fixes: 398ce273d6b1 ("wifi: brcmfmac: cfg80211: Add support for scan params v2")
Signed-off-by: Petr Tesarik 
Link: https://lore.kernel.org/r/20230802163430.1656-1-petrtesarik@huaweicloud.com
Signed-off-by: Johannes Berg

Merge tag 'wireless-next-2023-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2023-08-05T01:34:25+00:00

Kalle Valo says:

====================
wireless-next patches for v6.6

The first pull request for v6.6 and only driver patches this time.
Nothing special really standing out, it has been quiet most likely due
to vacations.

Major changes:

rtl8xxxu
 - enable AP mode for: RTL8192FU, RTL8710BU (RTL8188GU),
   RTL8192EU and RTL8723BU

mwifiex
 - allow moving to a different namespace

mt76
 - preparation for mt7925 support
 - mt7981 support

ath12k
 - Extremely High Throughput (EHT) PHY support for Wi-Fi 7

* tag 'wireless-next-2023-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (172 commits)
  wifi: rtw89: return failure if needed firmware elements are not recognized
  wifi: rtw89: add to parse firmware elements of BB and RF tables
  wifi: rtw89: introduce infrastructure of firmware elements
  wifi: rtw89: add firmware suit for BB MCU 0/1
  wifi: rtw89: add firmware parser for v1 format
  wifi: rtw89: introduce v1 format of firmware header
  wifi: rtw89: support firmware log with formatted text
  wifi: rtw89: recognize log format from firmware file
  wifi: ath12k: avoid deadlock by change ieee80211_queue_work for regd_update_work
  wifi: ath12k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
  wifi: ath12k: relax list iteration in ath12k_mac_vif_unref()
  wifi: ath12k: configure puncturing bitmap
  wifi: ath12k: parse WMI service ready ext2 event
  wifi: ath12k: add MLO header in peer association
  wifi: ath12k: peer assoc for 320 MHz
  wifi: ath12k: add WMI support for EHT peer
  wifi: ath12k: prepare EHT peer assoc parameters
  wifi: ath12k: add EHT PHY modes
  wifi: ath12k: propagate EHT capabilities to userspace
  wifi: ath12k: WMI support to process EHT capabilities
  ...
====================

Link: https://lore.kernel.org/r/87msz7j942.fsf@kernel.org
Signed-off-by: Jakub Kicinski

wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1()

2023-08-02T10:34:16+00:00

Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers
a backtrace caused by the following field-spanning warning:

memcpy: detected field-spanning write (size 120) of single field
  "¶ms_le->channel_list[0]" at
  drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2)

The driver still works after this warning. The warning was introduced by the
new field-spanning write checks which were enabled recently.

Fix this by replacing the channel_list[1] declaration at the end of
the struct with a flexible array declaration.

Most users of struct brcmf_scan_params_le calculate the size to alloc
using the size of the non flex-array part of the struct + needed extra
space, so they do not care about sizeof(struct brcmf_scan_params_le).

brcmf_notify_escan_complete() however uses the struct on the stack,
expecting there to be room for at least 1 entry in the channel-list
to store the special -1 abort channel-id.

To make this work use an anonymous union with a padding member
added + the actual channel_list flexible array.

Cc: Kees Cook 
Signed-off-by: Hans de Goede 
Reviewed-by: Kees Cook 
Reviewed-by: Franky Lin 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20230729140500.27892-1-hdegoede@redhat.com

wifi: brcmsmac: cleanup SCB-related data types

2023-08-02T10:11:07+00:00

Drop unused and set-but-unused fields of 'struct scb_ampdu_tid_ini',
'struct scb_ampdu' and 'struct scb', as well as now unused argument
of 'brcms_c_ampdu_tx_operational()', adjust related code.

Signed-off-by: Dmitry Antipov 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20230725162400.192357-2-dmantipov@yandex.ru

wifi: brcmsmac: remove more unused data types

2023-08-02T10:11:07+00:00

Remove unused 'struct brcmu_iovar' and 'struct tx_inst_power'. This
follows commit b2090d93d4b6 ("wifi: brcmsmac: remove unused data type").

Signed-off-by: Dmitry Antipov 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20230725162400.192357-1-dmantipov@yandex.ru

wifi: brcmsmac: remove unused data type

2023-07-25T15:16:03+00:00

Remove unused 'struct gpioh_item'. It seems it was so since
commit 5b435de0d786 ("net: wireless: add brcm80211 drivers").

Signed-off-by: Dmitry Antipov 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20230719083232.158177-1-dmantipov@yandex.ru

wifi: brcmsmac: fix gnu_printf warnings

2023-06-16T09:24:15+00:00

With GCC 13.1 and W=1 brcmsmac has warnings like this:

./include/trace/stages/stage5_get_offsets.h:23:31: warning: function 'trace_event_get_offsets_brcms_dbg' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format]

Add a workaround which disables -Wsuggest-attribute=format in
brcms_trace_brcmsmac_msg.h. I see similar workarounds in other drivers as well.

Compile tested only.

Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20230613140918.389690-3-kvalo@kernel.org

wifi: brcmfmac: fix gnu_printf warnings

2023-06-16T09:24:15+00:00

With GCC 13.1 and W=1 brcmfmac has warnings like this:

./include/trace/perf.h:26:16: warning: function 'perf_trace_brcmf_dbg' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format]

Add a workaround which disables -Wsuggest-attribute=format in tracepoint.h. I
see similar workarounds in other drivers as well.

Compile tested only.

Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20230613140918.389690-2-kvalo@kernel.org