linux-stable.git/drivers/net/wireless, branch v3.16.82

iwlwifi: check kasprintf() return value

2020-02-11T20:03:45+00:00

commit 5974fbb5e10b018fdbe3c3b81cb4cc54e1105ab9 upstream.

kasprintf() can fail, we should check the return value.

Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger")
Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver")
Signed-off-by: Johannes Berg 
Signed-off-by: Luca Coelho 
[bwh: Backported to 3.16: adjust filenames]
Signed-off-by: Ben Hutchings

ar5523: check NULL before memcpy() in ar5523_cmd()

2020-02-11T20:03:14+00:00

commit 315cee426f87658a6799815845788fde965ddaad upstream.

memcpy() call with "idata == NULL && ilen == 0" results in undefined
behavior in ar5523_cmd(). For example, NULL is passed in callchain
"ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
adds ilen check before memcpy() call in ar5523_cmd() to prevent an
undefined behavior.

Cc: Pontus Fuchs 
Cc: Kalle Valo 
Cc: "David S. Miller" 
Cc: David Laight 
Signed-off-by: Denis Efremov 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings

cw1200: Fix a signedness bug in cw1200_load_firmware()

2020-02-11T20:03:14+00:00

commit 4a50d454502f1401171ff061a5424583f91266db upstream.

The "priv->hw_type" is an enum and in this context GCC will treat it
as an unsigned int so the error handling will never trigger.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Dan Carpenter 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

ath9k_hw: fix uninitialized variable data

2020-02-11T20:03:12+00:00

commit 80e84f36412e0c5172447b6947068dca0d04ee82 upstream.

Currently, data variable in ar9003_hw_thermo_cal_apply() could be
uninitialized if ar9300_otp_read_word() will fail to read the value.
Initialize data variable with 0 to prevent an undefined behavior. This
will be enough to handle error case when ar9300_otp_read_word() fails.

Fixes: 80fe43f2bbd5 ("ath9k_hw: Read and configure thermocal for AR9462")
Cc: Rajkumar Manoharan 
Cc: John W. Linville 
Cc: Kalle Valo 
Cc: "David S. Miller" 
Signed-off-by: Denis Efremov 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings

mwifiex: fix possible heap overflow in mwifiex_process_country_ie()

2020-01-11T02:05:06+00:00

commit 3d94a4a8373bf5f45cf5f939e88b8354dbf2311b upstream.

mwifiex_process_country_ie() function parse elements of bss
descriptor in beacon packet. When processing WLAN_EID_COUNTRY
element, there is no upper limit check for country_ie_len before
calling memcpy. The destination buffer domain_info->triplet is an
array of length MWIFIEX_MAX_TRIPLET_802_11D(83). The remote
attacker can build a fake AP with the same ssid as real AP, and
send malicous beacon packet with long WLAN_EID_COUNTRY elemen
(country_ie_len > 83). Attacker can  force STA connect to fake AP
on a different channel. When the victim STA connects to fake AP,
will trigger the heap buffer overflow. Fix this by checking for
length and if found invalid, don not connect to the AP.

This fix addresses CVE-2019-14895.

Reported-by: huangwen 
Signed-off-by: Ganapathi Bhat 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16:
 - Use wiphy_dbg() instead of mwifiex_dbg()
 - Adjust filename]
Signed-off-by: Ben Hutchings

mwifiex: don't follow AP if country code received from EEPROM

2020-01-11T02:05:06+00:00

commit 947d315257f9b25b0e24f5706f8184b3b00774d4 upstream.

If device has already received country information from
EEPROM, we won't parse AP's country IE and download it to
firmware. We will also set regulatory flags to disable beacon
hints and ignore country IE.

Signed-off-by: Amitkumar Karwar 
Signed-off-by: Cathy Luo 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filenames, context]
Signed-off-by: Ben Hutchings

mwifiex: Fix NL80211_TX_POWER_LIMITED

2020-01-11T02:05:02+00:00

commit 65a576e27309120e0621f54d5c81eb9128bd56be upstream.

NL80211_TX_POWER_LIMITED was treated as NL80211_TX_POWER_AUTOMATIC,
which is the opposite of what should happen and can cause nasty
regulatory problems.

if/else converted to a switch without default to make gcc warn
on unhandled enum values.

Signed-off-by: Adrian Bunk 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filenames]
Signed-off-by: Ben Hutchings

mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring

2019-12-10T18:01:31+00:00

commit d10dcb615c8e29d403a24d35f8310a7a53e3050c upstream.

In mwifiex_pcie_init_evt_ring, a new skb is allocated which should be
released if mwifiex_map_pci_memory() fails. The release for skb and
card->evtbd_ring_vbase is added.

Fixes: 0732484b47b5 ("mwifiex: separate ring initialization and ring creation routines")
Signed-off-by: Navid Emamdoost 
Acked-by: Ganapathi Bhat 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf

2019-12-10T18:01:31+00:00

commit db8fd2cde93227e566a412cf53173ffa227998bc upstream.

In mwifiex_pcie_alloc_cmdrsp_buf, a new skb is allocated which should be
released if mwifiex_map_pci_memory() fails. The release is added.

Fixes: fc3314609047 ("mwifiex: use pci_alloc/free_consistent APIs for PCIe")
Signed-off-by: Navid Emamdoost 
Acked-by: Ganapathi Bhat 
Signed-off-by: Kalle Valo 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

libertas_tf: Use correct channel range in lbtf_geo_init

2019-12-10T18:01:10+00:00

commit 2ec4ad49b98e4a14147d04f914717135eca7c8b1 upstream.

It seems we should use 'range' instead of 'priv->range'
in lbtf_geo_init(), because 'range' is the corret one
related to current regioncode.

Reported-by: Hulk Robot 
Fixes: 691cdb49388b ("libertas_tf: command helper functions for libertas_tf")
Signed-off-by: YueHaibing 
Signed-off-by: Kalle Valo 
Signed-off-by: Ben Hutchings