linux-stable.git/drivers/net/wireless, branch v4.9.166

ath10k: avoid possible string overflow

2019-03-27T05:13:05+00:00

commit 6707ba0105a2d350710bc0a537a98f49eb4b895d upstream.

The way that 'strncat' is used here raised a warning in gcc-8:

drivers/net/wireless/ath/ath10k/wmi.c: In function 'ath10k_wmi_tpc_stats_final_disp_tables':
drivers/net/wireless/ath/ath10k/wmi.c:4649:4: error: 'strncat' output truncated before terminating nul copying as many bytes from a string as its length [-Werror=stringop-truncation]

Effectively, this is simply a strcat() but the use of strncat() suggests
some form of overflow check. Regardless of whether this might actually
overflow, using strlcat() instead of strncat() avoids the warning and
makes the code more robust.

Fixes: bc64d05220f3 ("ath10k: debugfs support to get final TPC stats for 10.4 variants")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer

2019-03-23T12:19:48+00:00

commit 607076a904c435f2677fadaadd4af546279db68b upstream.

It doesn't make sense and the USB core warns on each submit of such
URB, easily flooding the message buffer with tracebacks.

Analogous issue was fixed in regular libertas driver in commit 6528d8804780
("libertas: don't set URB_ZERO_PACKET on IN USB transfer").

Cc: stable@vger.kernel.org
Signed-off-by: Lubomir Rintel 
Reviewed-by: Steve deRosier 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

mac80211_hwsim: propagate genlmsg_reply return code

2019-03-23T12:19:44+00:00

[ Upstream commit 17407715240456448e4989bee46ffc93991add83 ]

genlmsg_reply can fail, so propagate its return code

Signed-off-by: Li RongQing 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

ath9k: dynack: check da->enabled first in sampling routines

2019-02-12T18:45:02+00:00

commit 9d3d65a91f027b8a9af5e63752d9b78cb10eb92d upstream.

Check da->enabled flag first in ath_dynack_sample_tx_ts and
ath_dynack_sample_ack_ts routines in order to avoid useless
processing

Tested-by: Koen Vandeputte 
Signed-off-by: Lorenzo Bianconi 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

ath9k: dynack: make ewma estimation faster

2019-02-12T18:45:02+00:00

commit 0c60c490830a1a756c80f8de8d33d9c6359d4a36 upstream.

In order to make propagation time estimation faster,
use current sample as ewma output value during 'late ack'
tracking

Tested-by: Koen Vandeputte 
Signed-off-by: Lorenzo Bianconi 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()

2019-02-12T18:44:56+00:00

[ Upstream commit 4f68ef64cd7feb1220232bd8f501d8aad340a099 ]

The function cw1200_bss_info_changed() and cw1200_hw_scan() can be
concurrently executed.
The two functions both access a possible shared variable "frame.skb".

This shared variable is freed by dev_kfree_skb() in cw1200_upload_beacon(),
which is called by cw1200_bss_info_changed(). The free operation is
protected by a mutex lock "priv->conf_mutex" in cw1200_bss_info_changed().

In cw1200_hw_scan(), this shared variable is accessed without the
protection of the mutex lock "priv->conf_mutex".
Thus, concurrency use-after-free bugs may occur.

To fix these bugs, the original calls to mutex_lock(&priv->conf_mutex) and
mutex_unlock(&priv->conf_mutex) are moved to the places, which can
protect the accesses to the shared variable.

Signed-off-by: Jia-Ju Bai 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

ath9k: dynack: use authentication messages for 'late' ack

2019-02-12T18:44:51+00:00

[ Upstream commit 3831a2a0010c72e3956020cbf1057a1701a2e469 ]

In order to properly support dynack in ad-hoc mode running
wpa_supplicant, take into account authentication frames for
'late ack' detection. This patch has been tested on devices
mounted on offshore high-voltage stations connected through
~24Km link

Reported-by: Koen Vandeputte 
Tested-by: Koen Vandeputte 
Signed-off-by: Lorenzo Bianconi 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin

b43: Fix error in cordic routine

2019-01-13T09:03:52+00:00

commit 8ea3819c0bbef57a51d8abe579e211033e861677 upstream.

The cordic routine for calculating sines and cosines that was added in
commit 6f98e62a9f1b ("b43: update cordic code to match current specs")
contains an error whereby a quantity declared u32 can in fact go negative.

This problem was detected by Priit Laes who is switching b43 to use the
routine in the library functions of the kernel.

Fixes: 986504540306 ("b43: make cordic common (LP-PHY and N-PHY need it)")
Reported-by: Priit Laes 
Cc: Rafał Miłecki 
Cc: Stable  # 2.6.34
Signed-off-by: Larry Finger 
Signed-off-by: Priit Laes 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

mac80211_hwsim: fix module init error paths for netlink

2018-12-21T13:11:35+00:00

[ Upstream commit 05cc09de4c017663a217630682041066f2f9a5cd ]

There is no unregister netlink notifier and family on error paths
in init_mac80211_hwsim(). Also there is an error path where
hwsim_class is not destroyed.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Fixes: 62759361eb49 ("mac80211-hwsim: Provide multicast event for HWSIM_CMD_NEW_RADIO")
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

mac80211_hwsim: Timer should be initialized before device registered

2018-12-13T08:20:30+00:00

commit a1881c9b8a1edef0a5ae1d5c1b61406fe3402114 upstream.

Otherwise if network manager starts configuring Wi-Fi interface
immidiatelly after getting notification of its creation, we will get
NULL pointer dereference:

  BUG: unable to handle kernel NULL pointer dereference at           (null)
  IP: [] hrtimer_active+0x28/0x50
  ...
  Call Trace:
   [] ? hrtimer_try_to_cancel+0x27/0x110
   [] ? hrtimer_cancel+0x15/0x20
   [] ? mac80211_hwsim_config+0x140/0x1c0 [mac80211_hwsim]

Cc: stable@vger.kernel.org
Signed-off-by: Vasyl Vavrychuk 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman