linux-stable.git/drivers/net/wireless/mediatek, branch linux-5.5.y Linux kernel stable tree mt76: fix array overflow on receiving too many fragments for a packet 2020-03-18T06:19:13+00:00 Felix Fietkau nbd@nbd.name 2020-02-20T11:41:39+00:00 fc09229baaaf75e068302b060f7f21548ba2ded6 commit b102f0c522cf668c8382c56a4f771b37d011cda2 upstream. If the hardware receives an oversized packet with too many rx fragments, skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. This becomes especially visible if it corrupts the freelist pointer of a slab page. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit b102f0c522cf668c8382c56a4f771b37d011cda2 upstream.

If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mt76: mt7615: fix max_nss in mt7615_eeprom_parse_hw_cap 2020-02-14T21:53:00+00:00 Lorenzo Bianconi lorenzo@kernel.org 2020-02-07T10:29:51+00:00 89ff861a95400c1021cebcc969e6550a1426cfac commit d08f3010f4a32eec3c8aa771f03a1b342a1472fa upstream. Fix u8 cast reading max_nss from MT_TOP_STRAP_STA register in mt7615_eeprom_parse_hw_cap routine Fixes: acf5457fd99db ("mt76: mt7615: read {tx,rx} mask from eeprom") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit d08f3010f4a32eec3c8aa771f03a1b342a1472fa upstream.

Fix u8 cast reading max_nss from MT_TOP_STRAP_STA register in
mt7615_eeprom_parse_hw_cap routine

Fixes: acf5457fd99db ("mt76: mt7615: read {tx,rx} mask from eeprom")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mt76: Off by one in mt76_calc_rx_airtime() 2019-12-18T18:50:40+00:00 Dan Carpenter dan.carpenter@oracle.com 2019-11-26T04:49:56+00:00 b43e36d75e8727f78892652a25967a1ffa03d1d1 The sband->bitrates[] array has "sband->n_bitrates" elements so this check needs to be >= instead of > or we could read beyond the end of the array. These values come from when we call mt76_register_device(): ret = mt76_register_device(&dev->mt76, true, mt7603_rates, ARRAY_SIZE(mt7603_rates)); Here sband->bitrates[] is mt7603_rates[] and ->n_bitrates is the ARRAY_SIZE() Fixes: 5ce09c1a7907 ("mt76: track rx airtime for airtime fairness and survey") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> 
The sband->bitrates[] array has "sband->n_bitrates" elements so this
check needs to be >= instead of > or we could read beyond the end of the
array.

These values come from when we call mt76_register_device():

	ret = mt76_register_device(&dev->mt76, true, mt7603_rates,
				   ARRAY_SIZE(mt7603_rates));

Here sband->bitrates[] is mt7603_rates[] and ->n_bitrates is the
ARRAY_SIZE()

Fixes: 5ce09c1a7907 ("mt76: track rx airtime for airtime fairness and survey")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
mt76: fix LED link time failure 2019-12-18T18:24:57+00:00 Arnd Bergmann arnd@arndb.de 2019-12-16T13:18:42+00:00 d68f4e43a46ff1f772ff73085f96d44eb4163e9d The mt76_led_cleanup() function is called unconditionally, which leads to a link error when CONFIG_LEDS is a loadable module or disabled but mt76 is built-in: drivers/net/wireless/mediatek/mt76/mac80211.o: In function `mt76_unregister_device': mac80211.c:(.text+0x2ac): undefined reference to `led_classdev_unregister' Use the same trick that is guarding the registration, using an IS_ENABLED() check for the CONFIG_MT76_LEDS symbol that indicates whether LEDs can be used or not. Fixes: 36f7e2b2bb1d ("mt76: do not use devm API for led classdev") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> 
The mt76_led_cleanup() function is called unconditionally, which
leads to a link error when CONFIG_LEDS is a loadable module or
disabled but mt76 is built-in:

drivers/net/wireless/mediatek/mt76/mac80211.o: In function `mt76_unregister_device':
mac80211.c:(.text+0x2ac): undefined reference to `led_classdev_unregister'

Use the same trick that is guarding the registration, using an
IS_ENABLED() check for the CONFIG_MT76_LEDS symbol that indicates
whether LEDs can be used or not.

Fixes: 36f7e2b2bb1d ("mt76: do not use devm API for led classdev")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
mt76: mt76x0: fix default mac address overwrite 2019-12-02T14:49:05+00:00 Lorenzo Bianconi lorenzo@kernel.org 2019-11-23T22:42:22+00:00 693d060536abca7b16d2fb8e66aa56be2a2443a2 Current implementation always use default eeprom mac address to configure device registers even if it is updated using mt76_eeprom_override. Fix it initializing macaddr filed of mt76_dev data structure with eeprom mac address and running mt76_eeprom_override before mt76x02_mac_setaddr Fixes: d1bc9bf2072c ("mt76: mt76x0: eeprom: add support for MAC address from OF") Tested-by: Kevin Schmidt <kevin.patrick.schmidt@googlemail.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> 
Current implementation always use default eeprom mac address to
configure device registers even if it is updated using
mt76_eeprom_override. Fix it initializing macaddr filed of mt76_dev data
structure with eeprom mac address and running mt76_eeprom_override
before mt76x02_mac_setaddr

Fixes: d1bc9bf2072c ("mt76: mt76x0: eeprom: add support for MAC address from OF")
Tested-by: Kevin Schmidt <kevin.patrick.schmidt@googlemail.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
mt76: fix fix ampdu locking 2019-11-21T18:38:30+00:00 Markus Theil markus.theil@tu-ilmenau.de 2019-11-20T20:05:31+00:00 05d6c8cfdbd6cefac6b373bad72775fcc4193c80 The current ampdu locking code does not unlock its mutex in the early return case. This patch fixes it. Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de> Acked-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> 
The current ampdu locking code does not unlock its mutex in the early
return case. This patch fixes it.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Acked-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
mt76: mt76u: fix endpoint definition order 2019-11-20T12:23:51+00:00 Lorenzo Bianconi lorenzo@kernel.org 2019-11-17T12:26:14+00:00 23cb16d2ccb5f819d7acff602e5a153157bf2884 Even if they are not currently used fix BK/BE endpoint definition order. Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> 
Even if they are not currently used fix BK/BE endpoint definition order.

Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
mt76: mt7615: read {tx,rx} mask from eeprom 2019-11-20T12:23:51+00:00 Lorenzo Bianconi lorenzo@kernel.org 2019-11-14T20:21:11+00:00 acf5457fd99db6c9a42ef280494dfee949ee1e09 Parse configured {tx,rx} mask from eeprom data instead of just setting it to four tx-rx streams Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> 
Parse configured {tx,rx} mask from eeprom data instead of just setting it
to four tx-rx streams

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
mt76: move mt76_get_antenna in mt76_core module 2019-11-20T12:23:51+00:00 Lorenzo Bianconi lorenzo@kernel.org 2019-11-14T15:12:07+00:00 e49c76d455a93b6cc978ae9e9fab2a1e551c147e Move mt76_get_antenna in mac80211.c in order to be reused by all drivers. Initialize .get_antenna function pointer for mt76x0, mt7603, mt7615 and mt76x2u drivers Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> 
Move mt76_get_antenna in mac80211.c in order to be reused by all
drivers. Initialize .get_antenna function pointer for mt76x0, mt7603,
mt7615 and mt76x2u drivers

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
mt76: fix possible out-of-bound access in mt7615_fill_txs/mt7603_fill_txs 2019-11-20T12:23:51+00:00 Lorenzo Bianconi lorenzo@kernel.org 2019-11-06T23:01:58+00:00 e8b970c8e367e85fab9b8ac4f36080e5d653c38e Fix possible out-of-bound access of status rates array in mt7615_fill_txs/mt7603_fill_txs routines Fixes: c5211e997eca ("mt76: mt7603: rework and fix tx status reporting") Fixes: 4af81f02b49c ("mt76: mt7615: sync with mt7603 rate control changes") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> 
Fix possible out-of-bound access of status rates array in
mt7615_fill_txs/mt7603_fill_txs routines

Fixes: c5211e997eca ("mt76: mt7603: rework and fix tx status reporting")
Fixes: 4af81f02b49c ("mt76: mt7615: sync with mt7603 rate control changes")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>