linux-stable.git/drivers/net/wireless/st, branch linux-5.15.y

wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()

2026-01-19T12:09:28+00:00

[ Upstream commit 5e88e864118c20e63a1571d0ff0a152e5d684959 ]

In one of the error paths, the memory allocated for skb_rx is not freed.
Fix that by freeing it before returning.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Abdun Nihaal 
Link: https://patch.msgid.link/20251110175316.106591-1-nihaal@cse.iitm.ac.in
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

wifi: cw1200: cap SSID length in cw1200_do_join()

2025-09-09T16:50:19+00:00

[ Upstream commit f8f15f6742b8874e59c9c715d0af3474608310ad ]

If the ssidie[1] length is more that 32 it leads to memory corruption.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Dan Carpenter 
Link: https://patch.msgid.link/e91fb43fcedc4893b604dfb973131661510901a7.1756456951.git.dan.carpenter@linaro.org
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

wifi: cw1200: Avoid processing an invalid TIM IE

2024-09-04T11:23:20+00:00

[ Upstream commit b7bcea9c27b3d87b54075735c870500123582145 ]

While converting struct ieee80211_tim_ie::virtual_map to be a flexible
array it was observed that the TIM IE processing in cw1200_rx_cb()
could potentially process a malformed IE in a manner that could result
in a buffer over-read. Add logic to verify that the TIM IE length is
large enough to hold a valid TIM payload before processing it.

Signed-off-by: Jeff Johnson 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20230831-ieee80211_tim_ie-v3-1-e10ff584ab5d@quicinc.com
Signed-off-by: Sasha Levin

wireless: Remove redundant 'flush_workqueue()' calls

2024-03-26T22:21:19+00:00

[ Upstream commit ff1cc2fa3055ee4c83839f38b74b4ee370a2291c ]

'destroy_workqueue()' already drains the queue before destroying it, so
there is no need to flush it explicitly.

Remove the redundant 'flush_workqueue()' calls.

This was generated with coccinelle:

@@
expression E;
@@
- 	flush_workqueue(E);
	destroy_workqueue(E);

Signed-off-by: Christophe JAILLET 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/0855d51423578ad019c0264dad3fe47a2e8af9c7.1633849511.git.christophe.jaillet@wanadoo.fr
Stable-dep-of: cb5942b77c05 ("wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces")
Signed-off-by: Sasha Levin

cw1200: Revert unnecessary patches that fix unreal use-after-free bugs

2021-06-15T13:41:22+00:00

A previous commit 4f68ef64cd7f ("cw1200: Fix concurrency
use-after-free bugs in cw1200_hw_scan()") tried to fix a seemingly
use-after-free bug between cw1200_bss_info_changed() and
cw1200_hw_scan(), where the former frees a sk_buff pointed
to by frame.skb, and the latter accesses the sk_buff
pointed to by frame.skb. However, this issue should be a
false alarm because:

(1) "frame.skb" is not a shared variable between the above
two functions, because "frame" is a local function variable,
each of the two functions has its own local "frame" - they
just happen to have the same variable name.

(2) the sk_buff(s) pointed to by these two "frame.skb" are
also two different object instances, they are individually
allocated by different dev_alloc_skb() within the two above
functions. To free one object instance will not invalidate
the access of another different one.

Based on these facts, the previous commit should be unnecessary.
Moreover, it also introduced a missing unlock which was
addressed in a subsequent commit 51c8d24101c7 ("cw1200: fix missing
unlock on error in cw1200_hw_scan()"). Now that the
original use-after-free is unreal, these two commits should
be reverted. This patch performs the reversion.

Fixes: 4f68ef64cd7f ("cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()")
Fixes: 51c8d24101c7 ("cw1200: fix missing unlock on error in cw1200_hw_scan()")
Signed-off-by: Hang Zhang 
Acked-by: Jia-Ju Bai 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20210521223238.25020-1-zh.nvgt@gmail.com

cw1200: add missing MODULE_DEVICE_TABLE

2021-06-15T13:38:22+00:00

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot 
Signed-off-by: Zou Wei 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/1620788714-14300-1-git-send-email-zou_wei@huawei.com

cw1200: Remove unused function pointer typedef wsm_*

2021-04-17T17:25:54+00:00

Remove the 'wsm_*' typedef as it is not used.

Signed-off-by: Chen Lin 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/1613449833-4910-1-git-send-email-chen45464546@163.com

cw1200: Remove unused function pointer typedef cw1200_wsm_handler

2021-04-17T17:25:09+00:00

Remove the 'cw1200_wsm_handler' typedef as it is not used.

Signed-off-by: Chen Lin 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/1613446918-4532-1-git-send-email-chen45464546@163.com

cw1200: txrx: convert comma to semicolon

2020-12-10T18:49:14+00:00

Replace a comma between expression statements by a semicolon.

Signed-off-by: Zheng Yongjun 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20201209135550.2004-1-zhengyongjun3@huawei.com

cw1200: fix missing destroy_workqueue() on error in cw1200_init_common

2020-11-24T15:08:16+00:00

Add the missing destroy_workqueue() before return from
cw1200_init_common in the error handling case.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Reported-by: Hulk Robot 
Signed-off-by: Qinglang Miao 
Signed-off-by: Kalle Valo 
Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com