linux-stable.git/drivers/net/wireless, branch v6.5.7 Linux kernel stable tree wifi: iwlwifi: mvm: Fix incorrect usage of scan API 2023-10-10T20:03:00+00:00 Ilan Peer ilan.peer@intel.com 2023-09-26T13:55:50+00:00 3c0a2419e8bec662dcd45a8d51b94d589545b946 [ Upstream commit 22061bfc57fe08c77141dc876b4af75603c4d61d ] The support for using link ID in the scan request API was only added in version 16. However, the code wrongly enabled this API usage also for older versions. Fix it. Reported-by: Antoine Beaupré <anarcat@debian.org> Fixes: e98b23d0d7b8 ("wifi: iwlwifi: mvm: Add support for SCAN API version 16") Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230926165546.086e635fbbe6.Ia660f35ca0b1079f2c2ea92fd8d14d8101a89d03@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 22061bfc57fe08c77141dc876b4af75603c4d61d ]

The support for using link ID in the scan request API was only
added in version 16. However, the code wrongly enabled this
API usage also for older versions. Fix it.

Reported-by: Antoine Beaupré <anarcat@debian.org>
Fixes: e98b23d0d7b8 ("wifi: iwlwifi: mvm: Add support for SCAN API version 16")
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230926165546.086e635fbbe6.Ia660f35ca0b1079f2c2ea92fd8d14d8101a89d03@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling 2023-10-10T20:03:00+00:00 Felix Fietkau nbd@nbd.name 2023-09-19T19:47:47+00:00 0e656b05ca2b6cb61516d1ebcf5b7ff80a149146 [ Upstream commit 684e45e120b82deccaf8b85633905304a3bbf56d ] On MT76x0, LNA gain should be applied for both external and internal LNA. On MT76x2, LNA gain should be treated as 0 for external LNA. Move the LNA type based logic to mt76x2 in order to fix mt76x0. Fixes: 2daa67588f34 ("mt76x0: unify lna_gain parsing") Reported-by: Shiji Yang <yangshiji66@outlook.com> Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230919194747.31647-1-nbd@nbd.name Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 684e45e120b82deccaf8b85633905304a3bbf56d ]

On MT76x0, LNA gain should be applied for both external and internal LNA.
On MT76x2, LNA gain should be treated as 0 for external LNA.
Move the LNA type based logic to mt76x2 in order to fix mt76x0.

Fixes: 2daa67588f34 ("mt76x0: unify lna_gain parsing")
Reported-by: Shiji Yang <yangshiji66@outlook.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230919194747.31647-1-nbd@nbd.name
Signed-off-by: Sasha Levin <sashal@kernel.org>
wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet 2023-10-10T20:02:59+00:00 Pin-yen Lin treapking@chromium.org 2023-09-08T10:41:12+00:00 be2ff39b1504c5359f4a083c1cfcad21d666e216 [ Upstream commit aef7a0300047e7b4707ea0411dc9597cba108fc8 ] Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc1042 headers. Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Pin-yen Lin <treapking@chromium.org> Acked-by: Brian Norris <briannorris@chromium.org> Reviewed-by: Matthew Wang <matthewmwang@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit aef7a0300047e7b4707ea0411dc9597cba108fc8 ]

Only skip the code path trying to access the rfc1042 headers when the
buffer is too small, so the driver can still process packets without
rfc1042 headers.

Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets")
Signed-off-by: Pin-yen Lin <treapking@chromium.org>
Acked-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Matthew Wang <matthewmwang@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
wifi: iwlwifi: mvm: Fix a memory corruption issue 2023-10-10T20:02:58+00:00 Christophe JAILLET christophe.jaillet@wanadoo.fr 2023-07-23T20:24:59+00:00 f06cdd8d4ba5252986f51f80cc30263636397128 [ Upstream commit 8ba438ef3cacc4808a63ed0ce24d4f0942cfe55d ] A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct ieee80211_channel'. So only 1 element is allocated in this array. When doing: mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the 'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void *)((u8 *)mvm->nvm_data->channels + 1); because of the "(u8 *)" cast, we add only 1 to the address of the beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just after. Remove the spurious casting so that the pointer arithmetic works as expected. Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Acked-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/23f0ec986ef1529055f4f93dcb3940a6cf8d9a94.1690143750.git.christophe.jaillet@wanadoo.fr Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 8ba438ef3cacc4808a63ed0ce24d4f0942cfe55d ]

A few lines above, space is kzalloc()'ed for:
	sizeof(struct iwl_nvm_data) +
	sizeof(struct ieee80211_channel) +
	sizeof(struct ieee80211_rate)

'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine.

At the end of this structure, there is the 'channels' flex array.
Each element is of type 'struct ieee80211_channel'.
So only 1 element is allocated in this array.

When doing:
  mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels;
We point at the first element of the 'channels' flex array.
So this is fine.

However, when doing:
  mvm->nvm_data->bands[0].bitrates =
			(void *)((u8 *)mvm->nvm_data->channels + 1);
because of the "(u8 *)" cast, we add only 1 to the address of the beginning
of the flex array.

It is likely that we want point at the 'struct ieee80211_rate' allocated
just after.

Remove the spurious casting so that the pointer arithmetic works as
expected.

Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/23f0ec986ef1529055f4f93dcb3940a6cf8d9a94.1690143750.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
wifi: iwlwifi: dbg_ini: fix structure packing 2023-10-10T20:02:58+00:00 Arnd Bergmann arnd@arndb.de 2023-06-16T09:03:34+00:00 1fb9204d193b1f450a322e795726d56db5d8a242 [ Upstream commit 424c82e8ad56756bb98b08268ffcf68d12d183eb ] The iwl_fw_ini_error_dump_range structure has conflicting alignment requirements for the inner union and the outer struct: In file included from drivers/net/wireless/intel/iwlwifi/fw/dbg.c:9: drivers/net/wireless/intel/iwlwifi/fw/error-dump.h:312:2: error: field within 'struct iwl_fw_ini_error_dump_range' is less aligned than 'union iwl_fw_ini_error_dump_range::(anonymous at drivers/net/wireless/intel/iwlwifi/fw/error-dump.h:312:2)' and is usually due to 'struct iwl_fw_ini_error_dump_range' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] union { As the original intention was apparently to make the entire structure unaligned, mark the innermost members the same way so the union becomes packed as well. Fixes: 973193554cae6 ("iwlwifi: dbg_ini: dump headers cleanup") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230616090343.2454061-1-arnd@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 424c82e8ad56756bb98b08268ffcf68d12d183eb ]

The iwl_fw_ini_error_dump_range structure has conflicting alignment
requirements for the inner union and the outer struct:

In file included from drivers/net/wireless/intel/iwlwifi/fw/dbg.c:9:
drivers/net/wireless/intel/iwlwifi/fw/error-dump.h:312:2: error: field  within 'struct iwl_fw_ini_error_dump_range' is less aligned than 'union iwl_fw_ini_error_dump_range::(anonymous at drivers/net/wireless/intel/iwlwifi/fw/error-dump.h:312:2)' and is usually due to 'struct iwl_fw_ini_error_dump_range' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
        union {

As the original intention was apparently to make the entire structure
unaligned, mark the innermost members the same way so the union
becomes packed as well.

Fixes: 973193554cae6 ("iwlwifi: dbg_ini: dump headers cleanup")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230616090343.2454061-1-arnd@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
iwlwifi: mvm: handle PS changes in vif_cfg_changed 2023-10-10T20:02:58+00:00 Gregory Greenman gregory.greenman@intel.com 2023-09-05T13:29:57+00:00 2cb1b8ed662c2d0a400d03100586a62d4f46acd6 [ Upstream commit 2d4caa1dbe915654d0e8845758d9c96e721377a8 ] Handling of BSS_CHANGED_PS was missing in vif_cfg_changed callback. Fix it. Fixes: 22c588343529 ("wifi: iwlwifi: mvm: replace bss_info_changed() with vif_cfg/link_info_changed()") Reported-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230905162939.5ef0c8230de6.Ieed265014988c50ec68fbff6d33821e4215f987f@changeid [note: patch looks bigger than it is due to reindentation] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 2d4caa1dbe915654d0e8845758d9c96e721377a8 ]

Handling of BSS_CHANGED_PS was missing in vif_cfg_changed
callback. Fix it.

Fixes: 22c588343529 ("wifi: iwlwifi: mvm: replace bss_info_changed() with vif_cfg/link_info_changed()")
Reported-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230905162939.5ef0c8230de6.Ieed265014988c50ec68fbff6d33821e4215f987f@changeid
[note: patch looks bigger than it is due to reindentation]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
wifi: mt76: fix lock dependency problem for wed_lock 2023-10-10T20:02:58+00:00 Lorenzo Bianconi lorenzo@kernel.org 2023-08-28T13:16:11+00:00 09316923e1a243931decca2a00d3b51e7f37bce3 [ Upstream commit 195273147e520844c1aae9fbf85cb6eb0bc0fdd7 ] Fix the following kernel depency lock holding wed_lock with BH disabled. [ 40.579696] mt798x-wmac 18000000.wifi: attaching wed device 0 version 2 [ 40.604648] platform 15010000.wed: MTK WED WO Firmware Version: DEV_000000, Build Time: 20221208202138 [ 40.613972] platform 15010000.wed: MTK WED WO Chip ID 00 Region 3 [ 40.943617] [ 40.945118] ======================================================== [ 40.951457] WARNING: possible irq lock inversion dependency detected [ 40.957797] 5.15.127 #0 Not tainted [ 40.961276] -------------------------------------------------------- [ 40.967614] insmod/2329 just changed the state of lock: [ 40.972827] ffffff8004003b08 (&dev->wed_lock){+.+.}-{2:2}, at: mt76_get_rxwi+0x1c/0xac [mt76] [ 40.981387] but this lock was taken by another, SOFTIRQ-safe lock in the past: [ 40.988592] (&q->lock){+.-.}-{2:2} [ 40.988602] [ 40.988602] [ 40.988602] and interrupts could create inverse lock ordering between them. [ 40.988602] [ 41.003445] [ 41.003445] other info that might help us debug this: [ 41.009957] Possible interrupt unsafe locking scenario: [ 41.009957] [ 41.016729] CPU0 CPU1 [ 41.021245] ---- ---- [ 41.025761] lock(&dev->wed_lock); [ 41.029241] local_irq_disable(); [ 41.035145] lock(&q->lock); [ 41.040620] lock(&dev->wed_lock); [ 41.046616] <Interrupt> [ 41.049223] lock(&q->lock); [ 41.052356] [ 41.052356] *** DEADLOCK *** [ 41.052356] [ 41.058260] 1 lock held by insmod/2329: [ 41.062085] #0: ffffff80003b9988 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x88/0x190 [ 41.070442] [ 41.070442] the shortest dependencies between 2nd lock and 1st lock: [ 41.078257] -> (&q->lock){+.-.}-{2:2} { [ 41.082177] HARDIRQ-ON-W at: [ 41.085396] lock_acquire+0xfc/0x2c0 [ 41.090787] _raw_spin_lock_bh+0x84/0xa0 [ 41.096525] mt76_dma_cleanup+0x24c/0x650 [mt76] [ 41.102977] mt76_dma_cleanup+0x614/0x650 [mt76] [ 41.109428] mt7915_eeprom_get_power_delta+0x1168/0x2464 [mt7915e] [ 41.117435] mt7915_eeprom_init+0x40/0x340 [mt7915e] [ 41.124222] cleanup_module+0x94/0xb28 [mt7915e] [ 41.130662] platform_probe+0x64/0xbc [ 41.136139] really_probe.part.0+0x98/0x2f4 [ 41.142134] __driver_probe_device+0x94/0x16c [ 41.148303] driver_probe_device+0x40/0x120 [ 41.154299] __driver_attach+0x94/0x190 [ 41.159947] bus_for_each_dev+0x5c/0x94 [ 41.165594] driver_attach+0x20/0x30 [ 41.170983] bus_add_driver+0x104/0x1f4 [ 41.176631] driver_register+0x74/0x120 [ 41.182280] __platform_driver_register+0x24/0x30 [ 41.188797] 0xffffffc000cb1074 [ 41.193754] do_one_initcall+0x70/0x2cc [ 41.199403] do_init_module+0x44/0x240 [ 41.204968] load_module+0x1f5c/0x2874 [ 41.210532] __do_sys_init_module+0x1d8/0x2ac [ 41.216702] __arm64_sys_init_module+0x18/0x20 [ 41.222958] invoke_syscall.constprop.0+0x4c/0xe0 [ 41.229474] do_el0_svc+0x50/0xf0 [ 41.234602] el0_svc+0x4c/0xcc [ 41.239471] el0t_64_sync_handler+0xe0/0x110 [ 41.245556] el0t_64_sync+0x15c/0x160 [ 41.251029] IN-SOFTIRQ-W at: [ 41.254249] lock_acquire+0xfc/0x2c0 [ 41.259638] _raw_spin_lock_bh+0x84/0xa0 [ 41.265372] mt76_queue_tx_complete+0x34/0x70 [mt76] [ 41.272170] mt76_free_pending_rxwi+0x36c/0x5d0 [mt76] [ 41.279140] mt76_free_pending_rxwi+0x5c0/0x5d0 [mt76] [ 41.286111] mt7915_eeprom_get_power_delta+0x620/0x2464 [mt7915e] [ 41.294026] __napi_poll.constprop.0+0x5c/0x230 [ 41.300372] net_rx_action+0xe4/0x294 [ 41.305847] _stext+0x154/0x4cc [ 41.310801] do_softirq+0xa4/0xbc [ 41.315930] __local_bh_enable_ip+0x168/0x174 [ 41.322097] napi_threaded_poll+0xbc/0x140 [ 41.328007] kthread+0x13c/0x150 [ 41.333049] ret_from_fork+0x10/0x20 [ 41.338437] INITIAL USE at: [ 41.341568] lock_acquire+0xfc/0x2c0 [ 41.346869] _raw_spin_lock_bh+0x84/0xa0 [ 41.352519] mt76_dma_cleanup+0x24c/0x650 [mt76] [ 41.358882] mt76_dma_cleanup+0x614/0x650 [mt76] [ 41.365245] mt7915_eeprom_get_power_delta+0x1168/0x2464 [mt7915e] [ 41.373160] mt7915_eeprom_init+0x40/0x340 [mt7915e] [ 41.379860] cleanup_module+0x94/0xb28 [mt7915e] [ 41.386213] platform_probe+0x64/0xbc [ 41.391602] really_probe.part.0+0x98/0x2f4 [ 41.397511] __driver_probe_device+0x94/0x16c [ 41.403594] driver_probe_device+0x40/0x120 [ 41.409502] __driver_attach+0x94/0x190 [ 41.415063] bus_for_each_dev+0x5c/0x94 [ 41.420625] driver_attach+0x20/0x30 [ 41.425926] bus_add_driver+0x104/0x1f4 [ 41.431487] driver_register+0x74/0x120 [ 41.437049] __platform_driver_register+0x24/0x30 [ 41.443479] 0xffffffc000cb1074 [ 41.448346] do_one_initcall+0x70/0x2cc [ 41.453907] do_init_module+0x44/0x240 [ 41.459383] load_module+0x1f5c/0x2874 [ 41.464860] __do_sys_init_module+0x1d8/0x2ac [ 41.470944] __arm64_sys_init_module+0x18/0x20 [ 41.477113] invoke_syscall.constprop.0+0x4c/0xe0 [ 41.483542] do_el0_svc+0x50/0xf0 [ 41.488582] el0_svc+0x4c/0xcc [ 41.493364] el0t_64_sync_handler+0xe0/0x110 [ 41.499361] el0t_64_sync+0x15c/0x160 [ 41.504748] } [ 41.506489] ... key at: [<ffffffc000c65ba0>] __this_module+0x3e0/0xffffffffffffa840 [mt76] [ 41.515371] ... acquired at: [ 41.518413] _raw_spin_lock+0x60/0x74 [ 41.522240] mt76_get_rxwi+0x1c/0xac [mt76] [ 41.526608] mt76_dma_cleanup+0x3e0/0x650 [mt76] [ 41.531410] mt76_dma_cleanup+0x614/0x650 [mt76] [ 41.536211] mt7915_dma_init+0x408/0x7b0 [mt7915e] [ 41.541177] mt7915_register_device+0x310/0x620 [mt7915e] [ 41.546749] mt7915_mmio_probe+0xcec/0x1d44 [mt7915e] [ 41.551973] platform_probe+0x64/0xbc [ 41.555802] really_probe.part.0+0x98/0x2f4 [ 41.560149] __driver_probe_device+0x94/0x16c [ 41.564670] driver_probe_device+0x40/0x120 [ 41.569017] __driver_attach+0x94/0x190 [ 41.573019] bus_for_each_dev+0x5c/0x94 [ 41.577018] driver_attach+0x20/0x30 [ 41.580758] bus_add_driver+0x104/0x1f4 [ 41.584758] driver_register+0x74/0x120 [ 41.588759] __platform_driver_register+0x24/0x30 [ 41.593628] init_module+0x74/0x1000 [mt7915e] [ 41.598248] do_one_initcall+0x70/0x2cc [ 41.602248] do_init_module+0x44/0x240 [ 41.606162] load_module+0x1f5c/0x2874 [ 41.610078] __do_sys_init_module+0x1d8/0x2ac [ 41.614600] __arm64_sys_init_module+0x18/0x20 [ 41.619209] invoke_syscall.constprop.0+0x4c/0xe0 [ 41.624076] do_el0_svc+0x50/0xf0 [ 41.627555] el0_svc+0x4c/0xcc [ 41.630776] el0t_64_sync_handler+0xe0/0x110 [ 41.635211] el0t_64_sync+0x15c/0x160 [ 41.639037] [ 41.640517] -> (&dev->wed_lock){+.+.}-{2:2} { [ 41.644872] HARDIRQ-ON-W at: [ 41.648003] lock_acquire+0xfc/0x2c0 [ 41.653219] _raw_spin_lock+0x60/0x74 [ 41.658520] mt76_free_pending_rxwi+0xc0/0x5d0 [mt76] [ 41.665232] mt76_dma_cleanup+0x1dc/0x650 [mt76] [ 41.671508] mt7915_eeprom_get_power_delta+0x1830/0x2464 [mt7915e] [ 41.679336] mt7915_unregister_device+0x5b4/0x910 [mt7915e] [ 41.686555] mt7915_eeprom_get_target_power+0xb8/0x230 [mt7915e] [ 41.694209] mt7986_wmac_enable+0xc30/0xcd0 [mt7915e] [ 41.700909] platform_remove+0x4c/0x64 [ 41.706298] __device_release_driver+0x194/0x240 [ 41.712554] driver_detach+0xc0/0x100 [ 41.717857] bus_remove_driver+0x54/0xac [ 41.723418] driver_unregister+0x2c/0x54 [ 41.728980] platform_driver_unregister+0x10/0x20 [ 41.735323] mt7915_ops+0x244/0xffffffffffffed58 [mt7915e] [ 41.742457] __arm64_sys_delete_module+0x170/0x23c [ 41.748887] invoke_syscall.constprop.0+0x4c/0xe0 [ 41.755229] do_el0_svc+0x50/0xf0 [ 41.760183] el0_svc+0x4c/0xcc [ 41.764878] el0t_64_sync_handler+0xe0/0x110 [ 41.770788] el0t_64_sync+0x15c/0x160 [ 41.776088] SOFTIRQ-ON-W at: [ 41.779220] lock_acquire+0xfc/0x2c0 [ 41.784435] _raw_spin_lock+0x60/0x74 [ 41.789737] mt76_get_rxwi+0x1c/0xac [mt76] [ 41.795580] mt7915_debugfs_rx_log+0x804/0xb74 [mt7915e] [ 41.802540] mtk_wed_start+0x970/0xaa0 [ 41.807929] mt7915_dma_start+0x26c/0x630 [mt7915e] [ 41.814455] mt7915_dma_start+0x5a4/0x630 [mt7915e] [ 41.820981] mt7915_dma_init+0x45c/0x7b0 [mt7915e] [ 41.827420] mt7915_register_device+0x310/0x620 [mt7915e] [ 41.834467] mt7915_mmio_probe+0xcec/0x1d44 [mt7915e] [ 41.841167] platform_probe+0x64/0xbc [ 41.846469] really_probe.part.0+0x98/0x2f4 [ 41.852291] __driver_probe_device+0x94/0x16c [ 41.858286] driver_probe_device+0x40/0x120 [ 41.864107] __driver_attach+0x94/0x190 [ 41.869582] bus_for_each_dev+0x5c/0x94 [ 41.875056] driver_attach+0x20/0x30 [ 41.880270] bus_add_driver+0x104/0x1f4 [ 41.885745] driver_register+0x74/0x120 [ 41.891221] __platform_driver_register+0x24/0x30 [ 41.897564] init_module+0x74/0x1000 [mt7915e] [ 41.903657] do_one_initcall+0x70/0x2cc [ 41.909130] do_init_module+0x44/0x240 [ 41.914520] load_module+0x1f5c/0x2874 [ 41.919909] __do_sys_init_module+0x1d8/0x2ac [ 41.925905] __arm64_sys_init_module+0x18/0x20 [ 41.931989] invoke_syscall.constprop.0+0x4c/0xe0 [ 41.938331] do_el0_svc+0x50/0xf0 [ 41.943285] el0_svc+0x4c/0xcc [ 41.947981] el0t_64_sync_handler+0xe0/0x110 [ 41.953892] el0t_64_sync+0x15c/0x160 [ 41.959192] INITIAL USE at: [ 41.962238] lock_acquire+0xfc/0x2c0 [ 41.967365] _raw_spin_lock+0x60/0x74 [ 41.972580] mt76_free_pending_rxwi+0xc0/0x5d0 [mt76] [ 41.979206] mt76_dma_cleanup+0x1dc/0x650 [mt76] [ 41.985395] mt7915_eeprom_get_power_delta+0x1830/0x2464 [mt7915e] [ 41.993137] mt7915_unregister_device+0x5b4/0x910 [mt7915e] [ 42.000270] mt7915_eeprom_get_target_power+0xb8/0x230 [mt7915e] [ 42.007837] mt7986_wmac_enable+0xc30/0xcd0 [mt7915e] [ 42.014450] platform_remove+0x4c/0x64 [ 42.019753] __device_release_driver+0x194/0x240 [ 42.025922] driver_detach+0xc0/0x100 [ 42.031137] bus_remove_driver+0x54/0xac [ 42.036612] driver_unregister+0x2c/0x54 [ 42.042087] platform_driver_unregister+0x10/0x20 [ 42.048344] mt7915_ops+0x244/0xffffffffffffed58 [mt7915e] [ 42.055391] __arm64_sys_delete_module+0x170/0x23c [ 42.061735] invoke_syscall.constprop.0+0x4c/0xe0 [ 42.067990] do_el0_svc+0x50/0xf0 [ 42.072857] el0_svc+0x4c/0xcc [ 42.077466] el0t_64_sync_handler+0xe0/0x110 [ 42.083289] el0t_64_sync+0x15c/0x160 [ 42.088503] } [ 42.090157] ... key at: [<ffffffc000c65c10>] __this_module+0x450/0xffffffffffffa840 [mt76] [ 42.098951] ... acquired at: [ 42.101907] __lock_acquire+0x718/0x1df0 [ 42.105994] lock_acquire+0xfc/0x2c0 [ 42.109734] _raw_spin_lock+0x60/0x74 [ 42.113561] mt76_get_rxwi+0x1c/0xac [mt76] [ 42.117929] mt7915_debugfs_rx_log+0x804/0xb74 [mt7915e] [ 42.123415] mtk_wed_start+0x970/0xaa0 [ 42.127328] mt7915_dma_start+0x26c/0x630 [mt7915e] [ 42.132379] mt7915_dma_start+0x5a4/0x630 [mt7915e] [ 42.137430] mt7915_dma_init+0x45c/0x7b0 [mt7915e] [ 42.142395] mt7915_register_device+0x310/0x620 [mt7915e] [ 42.147967] mt7915_mmio_probe+0xcec/0x1d44 [mt7915e] [ 42.153192] platform_probe+0x64/0xbc [ 42.157019] really_probe.part.0+0x98/0x2f4 [ 42.161367] __driver_probe_device+0x94/0x16c [ 42.165887] driver_probe_device+0x40/0x120 [ 42.170234] __driver_attach+0x94/0x190 [ 42.174235] bus_for_each_dev+0x5c/0x94 [ 42.178235] driver_attach+0x20/0x30 [ 42.181974] bus_add_driver+0x104/0x1f4 [ 42.185974] driver_register+0x74/0x120 [ 42.189974] __platform_driver_register+0x24/0x30 [ 42.194842] init_module+0x74/0x1000 [mt7915e] [ 42.199460] do_one_initcall+0x70/0x2cc [ 42.203460] do_init_module+0x44/0x240 [ 42.207376] load_module+0x1f5c/0x2874 [ 42.211290] __do_sys_init_module+0x1d8/0x2ac [ 42.215813] __arm64_sys_init_module+0x18/0x20 [ 42.220421] invoke_syscall.constprop.0+0x4c/0xe0 [ 42.225288] do_el0_svc+0x50/0xf0 [ 42.228768] el0_svc+0x4c/0xcc [ 42.231989] el0t_64_sync_handler+0xe0/0x110 [ 42.236424] el0t_64_sync+0x15c/0x160 [ 42.240249] [ 42.241730] [ 42.241730] stack backtrace: [ 42.246074] CPU: 1 PID: 2329 Comm: insmod Not tainted 5.15.127 #0 [ 42.252157] Hardware name: GainStrong Oolite-MT7981B V1 Dev Board (NAND boot) (DT) [ 42.259712] Call trace: [ 42.262147] dump_backtrace+0x0/0x174 [ 42.265802] show_stack+0x14/0x20 [ 42.269108] dump_stack_lvl+0x84/0xac [ 42.272761] dump_stack+0x14/0x2c [ 42.276066] print_irq_inversion_bug.part.0+0x1b0/0x1c4 [ 42.281285] mark_lock+0x8b8/0x8bc [ 42.284678] __lock_acquire+0x718/0x1df0 [ 42.288592] lock_acquire+0xfc/0x2c0 [ 42.292158] _raw_spin_lock+0x60/0x74 [ 42.295811] mt76_get_rxwi+0x1c/0xac [mt76] [ 42.300008] mt7915_debugfs_rx_log+0x804/0xb74 [mt7915e] [ 42.305320] mtk_wed_start+0x970/0xaa0 [ 42.309059] mt7915_dma_start+0x26c/0x630 [mt7915e] [ 42.313937] mt7915_dma_start+0x5a4/0x630 [mt7915e] [ 42.318815] mt7915_dma_init+0x45c/0x7b0 [mt7915e] [ 42.323606] mt7915_register_device+0x310/0x620 [mt7915e] [ 42.329005] mt7915_mmio_probe+0xcec/0x1d44 [mt7915e] [ 42.334056] platform_probe+0x64/0xbc [ 42.337711] really_probe.part.0+0x98/0x2f4 [ 42.341885] __driver_probe_device+0x94/0x16c [ 42.346232] driver_probe_device+0x40/0x120 [ 42.350407] __driver_attach+0x94/0x190 [ 42.354234] bus_for_each_dev+0x5c/0x94 [ 42.358061] driver_attach+0x20/0x30 [ 42.361627] bus_add_driver+0x104/0x1f4 [ 42.365454] driver_register+0x74/0x120 [ 42.369282] __platform_driver_register+0x24/0x30 [ 42.373977] init_module+0x74/0x1000 [mt7915e] [ 42.378423] do_one_initcall+0x70/0x2cc [ 42.382249] do_init_module+0x44/0x240 [ 42.385990] load_module+0x1f5c/0x2874 [ 42.389733] __do_sys_init_module+0x1d8/0x2ac [ 42.394082] __arm64_sys_init_module+0x18/0x20 [ 42.398518] invoke_syscall.constprop.0+0x4c/0xe0 [ 42.403211] do_el0_svc+0x50/0xf0 [ 42.406517] el0_svc+0x4c/0xcc [ 42.409565] el0t_64_sync_handler+0xe0/0x110 [ 42.413827] el0t_64_sync+0x15c/0x160 [ 42.674858] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221208201745a [ 42.674858] [ 42.692078] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221208201806 [ 42.735606] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221208202048 Tested-by: Daniel Golle <daniel@makrotopia.org> Fixes: 2666bece0905 ("wifi: mt76: introduce rxwi and rx token utility routines") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Acked-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/ee80be41c2a8d8749d83c6950a272a5e77aadd45.1693228333.git.lorenzo@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 195273147e520844c1aae9fbf85cb6eb0bc0fdd7 ]

Fix the following kernel depency lock holding wed_lock with BH disabled.

[   40.579696] mt798x-wmac 18000000.wifi: attaching wed device 0 version 2
[   40.604648] platform 15010000.wed: MTK WED WO Firmware Version: DEV_000000, Build Time: 20221208202138
[   40.613972] platform 15010000.wed: MTK WED WO Chip ID 00 Region 3
[   40.943617]
[   40.945118] ========================================================
[   40.951457] WARNING: possible irq lock inversion dependency detected
[   40.957797] 5.15.127 #0 Not tainted
[   40.961276] --------------------------------------------------------
[   40.967614] insmod/2329 just changed the state of lock:
[   40.972827] ffffff8004003b08 (&dev->wed_lock){+.+.}-{2:2}, at: mt76_get_rxwi+0x1c/0xac [mt76]
[   40.981387] but this lock was taken by another, SOFTIRQ-safe lock in the past:
[   40.988592]  (&q->lock){+.-.}-{2:2}
[   40.988602]
[   40.988602]
[   40.988602] and interrupts could create inverse lock ordering between them.
[   40.988602]
[   41.003445]
[   41.003445] other info that might help us debug this:
[   41.009957]  Possible interrupt unsafe locking scenario:
[   41.009957]
[   41.016729]        CPU0                    CPU1
[   41.021245]        ----                    ----
[   41.025761]   lock(&dev->wed_lock);
[   41.029241]                                local_irq_disable();
[   41.035145]                                lock(&q->lock);
[   41.040620]                                lock(&dev->wed_lock);
[   41.046616]   <Interrupt>
[   41.049223]     lock(&q->lock);
[   41.052356]
[   41.052356]  *** DEADLOCK ***
[   41.052356]
[   41.058260] 1 lock held by insmod/2329:
[   41.062085]  #0: ffffff80003b9988 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x88/0x190
[   41.070442]
[   41.070442] the shortest dependencies between 2nd lock and 1st lock:
[   41.078257]  -> (&q->lock){+.-.}-{2:2} {
[   41.082177]     HARDIRQ-ON-W at:
[   41.085396]                       lock_acquire+0xfc/0x2c0
[   41.090787]                       _raw_spin_lock_bh+0x84/0xa0
[   41.096525]                       mt76_dma_cleanup+0x24c/0x650 [mt76]
[   41.102977]                       mt76_dma_cleanup+0x614/0x650 [mt76]
[   41.109428]                       mt7915_eeprom_get_power_delta+0x1168/0x2464 [mt7915e]
[   41.117435]                       mt7915_eeprom_init+0x40/0x340 [mt7915e]
[   41.124222]                       cleanup_module+0x94/0xb28 [mt7915e]
[   41.130662]                       platform_probe+0x64/0xbc
[   41.136139]                       really_probe.part.0+0x98/0x2f4
[   41.142134]                       __driver_probe_device+0x94/0x16c
[   41.148303]                       driver_probe_device+0x40/0x120
[   41.154299]                       __driver_attach+0x94/0x190
[   41.159947]                       bus_for_each_dev+0x5c/0x94
[   41.165594]                       driver_attach+0x20/0x30
[   41.170983]                       bus_add_driver+0x104/0x1f4
[   41.176631]                       driver_register+0x74/0x120
[   41.182280]                       __platform_driver_register+0x24/0x30
[   41.188797]                       0xffffffc000cb1074
[   41.193754]                       do_one_initcall+0x70/0x2cc
[   41.199403]                       do_init_module+0x44/0x240
[   41.204968]                       load_module+0x1f5c/0x2874
[   41.210532]                       __do_sys_init_module+0x1d8/0x2ac
[   41.216702]                       __arm64_sys_init_module+0x18/0x20
[   41.222958]                       invoke_syscall.constprop.0+0x4c/0xe0
[   41.229474]                       do_el0_svc+0x50/0xf0
[   41.234602]                       el0_svc+0x4c/0xcc
[   41.239471]                       el0t_64_sync_handler+0xe0/0x110
[   41.245556]                       el0t_64_sync+0x15c/0x160
[   41.251029]     IN-SOFTIRQ-W at:
[   41.254249]                       lock_acquire+0xfc/0x2c0
[   41.259638]                       _raw_spin_lock_bh+0x84/0xa0
[   41.265372]                       mt76_queue_tx_complete+0x34/0x70 [mt76]
[   41.272170]                       mt76_free_pending_rxwi+0x36c/0x5d0 [mt76]
[   41.279140]                       mt76_free_pending_rxwi+0x5c0/0x5d0 [mt76]
[   41.286111]                       mt7915_eeprom_get_power_delta+0x620/0x2464 [mt7915e]
[   41.294026]                       __napi_poll.constprop.0+0x5c/0x230
[   41.300372]                       net_rx_action+0xe4/0x294
[   41.305847]                       _stext+0x154/0x4cc
[   41.310801]                       do_softirq+0xa4/0xbc
[   41.315930]                       __local_bh_enable_ip+0x168/0x174
[   41.322097]                       napi_threaded_poll+0xbc/0x140
[   41.328007]                       kthread+0x13c/0x150
[   41.333049]                       ret_from_fork+0x10/0x20
[   41.338437]     INITIAL USE at:
[   41.341568]                      lock_acquire+0xfc/0x2c0
[   41.346869]                      _raw_spin_lock_bh+0x84/0xa0
[   41.352519]                      mt76_dma_cleanup+0x24c/0x650 [mt76]
[   41.358882]                      mt76_dma_cleanup+0x614/0x650 [mt76]
[   41.365245]                      mt7915_eeprom_get_power_delta+0x1168/0x2464 [mt7915e]
[   41.373160]                      mt7915_eeprom_init+0x40/0x340 [mt7915e]
[   41.379860]                      cleanup_module+0x94/0xb28 [mt7915e]
[   41.386213]                      platform_probe+0x64/0xbc
[   41.391602]                      really_probe.part.0+0x98/0x2f4
[   41.397511]                      __driver_probe_device+0x94/0x16c
[   41.403594]                      driver_probe_device+0x40/0x120
[   41.409502]                      __driver_attach+0x94/0x190
[   41.415063]                      bus_for_each_dev+0x5c/0x94
[   41.420625]                      driver_attach+0x20/0x30
[   41.425926]                      bus_add_driver+0x104/0x1f4
[   41.431487]                      driver_register+0x74/0x120
[   41.437049]                      __platform_driver_register+0x24/0x30
[   41.443479]                      0xffffffc000cb1074
[   41.448346]                      do_one_initcall+0x70/0x2cc
[   41.453907]                      do_init_module+0x44/0x240
[   41.459383]                      load_module+0x1f5c/0x2874
[   41.464860]                      __do_sys_init_module+0x1d8/0x2ac
[   41.470944]                      __arm64_sys_init_module+0x18/0x20
[   41.477113]                      invoke_syscall.constprop.0+0x4c/0xe0
[   41.483542]                      do_el0_svc+0x50/0xf0
[   41.488582]                      el0_svc+0x4c/0xcc
[   41.493364]                      el0t_64_sync_handler+0xe0/0x110
[   41.499361]                      el0t_64_sync+0x15c/0x160
[   41.504748]   }
[   41.506489]   ... key      at: [<ffffffc000c65ba0>] __this_module+0x3e0/0xffffffffffffa840 [mt76]
[   41.515371]   ... acquired at:
[   41.518413]    _raw_spin_lock+0x60/0x74
[   41.522240]    mt76_get_rxwi+0x1c/0xac [mt76]
[   41.526608]    mt76_dma_cleanup+0x3e0/0x650 [mt76]
[   41.531410]    mt76_dma_cleanup+0x614/0x650 [mt76]
[   41.536211]    mt7915_dma_init+0x408/0x7b0 [mt7915e]
[   41.541177]    mt7915_register_device+0x310/0x620 [mt7915e]
[   41.546749]    mt7915_mmio_probe+0xcec/0x1d44 [mt7915e]
[   41.551973]    platform_probe+0x64/0xbc
[   41.555802]    really_probe.part.0+0x98/0x2f4
[   41.560149]    __driver_probe_device+0x94/0x16c
[   41.564670]    driver_probe_device+0x40/0x120
[   41.569017]    __driver_attach+0x94/0x190
[   41.573019]    bus_for_each_dev+0x5c/0x94
[   41.577018]    driver_attach+0x20/0x30
[   41.580758]    bus_add_driver+0x104/0x1f4
[   41.584758]    driver_register+0x74/0x120
[   41.588759]    __platform_driver_register+0x24/0x30
[   41.593628]    init_module+0x74/0x1000 [mt7915e]
[   41.598248]    do_one_initcall+0x70/0x2cc
[   41.602248]    do_init_module+0x44/0x240
[   41.606162]    load_module+0x1f5c/0x2874
[   41.610078]    __do_sys_init_module+0x1d8/0x2ac
[   41.614600]    __arm64_sys_init_module+0x18/0x20
[   41.619209]    invoke_syscall.constprop.0+0x4c/0xe0
[   41.624076]    do_el0_svc+0x50/0xf0
[   41.627555]    el0_svc+0x4c/0xcc
[   41.630776]    el0t_64_sync_handler+0xe0/0x110
[   41.635211]    el0t_64_sync+0x15c/0x160
[   41.639037]
[   41.640517] -> (&dev->wed_lock){+.+.}-{2:2} {
[   41.644872]    HARDIRQ-ON-W at:
[   41.648003]                     lock_acquire+0xfc/0x2c0
[   41.653219]                     _raw_spin_lock+0x60/0x74
[   41.658520]                     mt76_free_pending_rxwi+0xc0/0x5d0 [mt76]
[   41.665232]                     mt76_dma_cleanup+0x1dc/0x650 [mt76]
[   41.671508]                     mt7915_eeprom_get_power_delta+0x1830/0x2464 [mt7915e]
[   41.679336]                     mt7915_unregister_device+0x5b4/0x910 [mt7915e]
[   41.686555]                     mt7915_eeprom_get_target_power+0xb8/0x230 [mt7915e]
[   41.694209]                     mt7986_wmac_enable+0xc30/0xcd0 [mt7915e]
[   41.700909]                     platform_remove+0x4c/0x64
[   41.706298]                     __device_release_driver+0x194/0x240
[   41.712554]                     driver_detach+0xc0/0x100
[   41.717857]                     bus_remove_driver+0x54/0xac
[   41.723418]                     driver_unregister+0x2c/0x54
[   41.728980]                     platform_driver_unregister+0x10/0x20
[   41.735323]                     mt7915_ops+0x244/0xffffffffffffed58 [mt7915e]
[   41.742457]                     __arm64_sys_delete_module+0x170/0x23c
[   41.748887]                     invoke_syscall.constprop.0+0x4c/0xe0
[   41.755229]                     do_el0_svc+0x50/0xf0
[   41.760183]                     el0_svc+0x4c/0xcc
[   41.764878]                     el0t_64_sync_handler+0xe0/0x110
[   41.770788]                     el0t_64_sync+0x15c/0x160
[   41.776088]    SOFTIRQ-ON-W at:
[   41.779220]                     lock_acquire+0xfc/0x2c0
[   41.784435]                     _raw_spin_lock+0x60/0x74
[   41.789737]                     mt76_get_rxwi+0x1c/0xac [mt76]
[   41.795580]                     mt7915_debugfs_rx_log+0x804/0xb74 [mt7915e]
[   41.802540]                     mtk_wed_start+0x970/0xaa0
[   41.807929]                     mt7915_dma_start+0x26c/0x630 [mt7915e]
[   41.814455]                     mt7915_dma_start+0x5a4/0x630 [mt7915e]
[   41.820981]                     mt7915_dma_init+0x45c/0x7b0 [mt7915e]
[   41.827420]                     mt7915_register_device+0x310/0x620 [mt7915e]
[   41.834467]                     mt7915_mmio_probe+0xcec/0x1d44 [mt7915e]
[   41.841167]                     platform_probe+0x64/0xbc
[   41.846469]                     really_probe.part.0+0x98/0x2f4
[   41.852291]                     __driver_probe_device+0x94/0x16c
[   41.858286]                     driver_probe_device+0x40/0x120
[   41.864107]                     __driver_attach+0x94/0x190
[   41.869582]                     bus_for_each_dev+0x5c/0x94
[   41.875056]                     driver_attach+0x20/0x30
[   41.880270]                     bus_add_driver+0x104/0x1f4
[   41.885745]                     driver_register+0x74/0x120
[   41.891221]                     __platform_driver_register+0x24/0x30
[   41.897564]                     init_module+0x74/0x1000 [mt7915e]
[   41.903657]                     do_one_initcall+0x70/0x2cc
[   41.909130]                     do_init_module+0x44/0x240
[   41.914520]                     load_module+0x1f5c/0x2874
[   41.919909]                     __do_sys_init_module+0x1d8/0x2ac
[   41.925905]                     __arm64_sys_init_module+0x18/0x20
[   41.931989]                     invoke_syscall.constprop.0+0x4c/0xe0
[   41.938331]                     do_el0_svc+0x50/0xf0
[   41.943285]                     el0_svc+0x4c/0xcc
[   41.947981]                     el0t_64_sync_handler+0xe0/0x110
[   41.953892]                     el0t_64_sync+0x15c/0x160
[   41.959192]    INITIAL USE at:
[   41.962238]                    lock_acquire+0xfc/0x2c0
[   41.967365]                    _raw_spin_lock+0x60/0x74
[   41.972580]                    mt76_free_pending_rxwi+0xc0/0x5d0 [mt76]
[   41.979206]                    mt76_dma_cleanup+0x1dc/0x650 [mt76]
[   41.985395]                    mt7915_eeprom_get_power_delta+0x1830/0x2464 [mt7915e]
[   41.993137]                    mt7915_unregister_device+0x5b4/0x910 [mt7915e]
[   42.000270]                    mt7915_eeprom_get_target_power+0xb8/0x230 [mt7915e]
[   42.007837]                    mt7986_wmac_enable+0xc30/0xcd0 [mt7915e]
[   42.014450]                    platform_remove+0x4c/0x64
[   42.019753]                    __device_release_driver+0x194/0x240
[   42.025922]                    driver_detach+0xc0/0x100
[   42.031137]                    bus_remove_driver+0x54/0xac
[   42.036612]                    driver_unregister+0x2c/0x54
[   42.042087]                    platform_driver_unregister+0x10/0x20
[   42.048344]                    mt7915_ops+0x244/0xffffffffffffed58 [mt7915e]
[   42.055391]                    __arm64_sys_delete_module+0x170/0x23c
[   42.061735]                    invoke_syscall.constprop.0+0x4c/0xe0
[   42.067990]                    do_el0_svc+0x50/0xf0
[   42.072857]                    el0_svc+0x4c/0xcc
[   42.077466]                    el0t_64_sync_handler+0xe0/0x110
[   42.083289]                    el0t_64_sync+0x15c/0x160
[   42.088503]  }
[   42.090157]  ... key      at: [<ffffffc000c65c10>] __this_module+0x450/0xffffffffffffa840 [mt76]
[   42.098951]  ... acquired at:
[   42.101907]    __lock_acquire+0x718/0x1df0
[   42.105994]    lock_acquire+0xfc/0x2c0
[   42.109734]    _raw_spin_lock+0x60/0x74
[   42.113561]    mt76_get_rxwi+0x1c/0xac [mt76]
[   42.117929]    mt7915_debugfs_rx_log+0x804/0xb74 [mt7915e]
[   42.123415]    mtk_wed_start+0x970/0xaa0
[   42.127328]    mt7915_dma_start+0x26c/0x630 [mt7915e]
[   42.132379]    mt7915_dma_start+0x5a4/0x630 [mt7915e]
[   42.137430]    mt7915_dma_init+0x45c/0x7b0 [mt7915e]
[   42.142395]    mt7915_register_device+0x310/0x620 [mt7915e]
[   42.147967]    mt7915_mmio_probe+0xcec/0x1d44 [mt7915e]
[   42.153192]    platform_probe+0x64/0xbc
[   42.157019]    really_probe.part.0+0x98/0x2f4
[   42.161367]    __driver_probe_device+0x94/0x16c
[   42.165887]    driver_probe_device+0x40/0x120
[   42.170234]    __driver_attach+0x94/0x190
[   42.174235]    bus_for_each_dev+0x5c/0x94
[   42.178235]    driver_attach+0x20/0x30
[   42.181974]    bus_add_driver+0x104/0x1f4
[   42.185974]    driver_register+0x74/0x120
[   42.189974]    __platform_driver_register+0x24/0x30
[   42.194842]    init_module+0x74/0x1000 [mt7915e]
[   42.199460]    do_one_initcall+0x70/0x2cc
[   42.203460]    do_init_module+0x44/0x240
[   42.207376]    load_module+0x1f5c/0x2874
[   42.211290]    __do_sys_init_module+0x1d8/0x2ac
[   42.215813]    __arm64_sys_init_module+0x18/0x20
[   42.220421]    invoke_syscall.constprop.0+0x4c/0xe0
[   42.225288]    do_el0_svc+0x50/0xf0
[   42.228768]    el0_svc+0x4c/0xcc
[   42.231989]    el0t_64_sync_handler+0xe0/0x110
[   42.236424]    el0t_64_sync+0x15c/0x160
[   42.240249]
[   42.241730]
[   42.241730] stack backtrace:
[   42.246074] CPU: 1 PID: 2329 Comm: insmod Not tainted 5.15.127 #0
[   42.252157] Hardware name: GainStrong Oolite-MT7981B V1 Dev Board (NAND boot) (DT)
[   42.259712] Call trace:
[   42.262147]  dump_backtrace+0x0/0x174
[   42.265802]  show_stack+0x14/0x20
[   42.269108]  dump_stack_lvl+0x84/0xac
[   42.272761]  dump_stack+0x14/0x2c
[   42.276066]  print_irq_inversion_bug.part.0+0x1b0/0x1c4
[   42.281285]  mark_lock+0x8b8/0x8bc
[   42.284678]  __lock_acquire+0x718/0x1df0
[   42.288592]  lock_acquire+0xfc/0x2c0
[   42.292158]  _raw_spin_lock+0x60/0x74
[   42.295811]  mt76_get_rxwi+0x1c/0xac [mt76]
[   42.300008]  mt7915_debugfs_rx_log+0x804/0xb74 [mt7915e]
[   42.305320]  mtk_wed_start+0x970/0xaa0
[   42.309059]  mt7915_dma_start+0x26c/0x630 [mt7915e]
[   42.313937]  mt7915_dma_start+0x5a4/0x630 [mt7915e]
[   42.318815]  mt7915_dma_init+0x45c/0x7b0 [mt7915e]
[   42.323606]  mt7915_register_device+0x310/0x620 [mt7915e]
[   42.329005]  mt7915_mmio_probe+0xcec/0x1d44 [mt7915e]
[   42.334056]  platform_probe+0x64/0xbc
[   42.337711]  really_probe.part.0+0x98/0x2f4
[   42.341885]  __driver_probe_device+0x94/0x16c
[   42.346232]  driver_probe_device+0x40/0x120
[   42.350407]  __driver_attach+0x94/0x190
[   42.354234]  bus_for_each_dev+0x5c/0x94
[   42.358061]  driver_attach+0x20/0x30
[   42.361627]  bus_add_driver+0x104/0x1f4
[   42.365454]  driver_register+0x74/0x120
[   42.369282]  __platform_driver_register+0x24/0x30
[   42.373977]  init_module+0x74/0x1000 [mt7915e]
[   42.378423]  do_one_initcall+0x70/0x2cc
[   42.382249]  do_init_module+0x44/0x240
[   42.385990]  load_module+0x1f5c/0x2874
[   42.389733]  __do_sys_init_module+0x1d8/0x2ac
[   42.394082]  __arm64_sys_init_module+0x18/0x20
[   42.398518]  invoke_syscall.constprop.0+0x4c/0xe0
[   42.403211]  do_el0_svc+0x50/0xf0
[   42.406517]  el0_svc+0x4c/0xcc
[   42.409565]  el0t_64_sync_handler+0xe0/0x110
[   42.413827]  el0t_64_sync+0x15c/0x160
[   42.674858] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221208201745a
[   42.674858]
[   42.692078] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221208201806
[   42.735606] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221208202048

Tested-by: Daniel Golle <daniel@makrotopia.org>
Fixes: 2666bece0905 ("wifi: mt76: introduce rxwi and rx token utility routines")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/ee80be41c2a8d8749d83c6950a272a5e77aadd45.1693228333.git.lorenzo@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
wifi: mwifiex: Fix tlv_buf_left calculation 2023-10-10T20:02:56+00:00 Gustavo A. R. Silva gustavoars@kernel.org 2023-08-25T03:06:51+00:00 62aba312578c6d056ec375bf71725afbd86dd4a9 commit eec679e4ac5f47507774956fb3479c206e761af7 upstream. In a TLV encoding scheme, the Length part represents the length after the header containing the values for type and length. In this case, `tlv_len` should be: tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len Notice that the `- 1` accounts for the one-element array `bitmap`, which 1-byte size is already included in `sizeof(*tlv_rxba)`. So, if the above is correct, there is a double-counting of some members in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp` are calculated: 968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len); 969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba); in specific, members: drivers/net/wireless/marvell/mwifiex/fw.h:777 777 u8 mac[ETH_ALEN]; 778 u8 tid; 779 u8 reserved; 780 __le16 seq_num; 781 __le16 bitmap_len; This is clearly wrong, and affects the subsequent decoding of data in `event_buf` through `tlv_rxba`: 970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp; Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)` in the calculation of `tlv_buf_left` and `tmp`. This results in the following binary differences before/after changes: | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o | @@ -4698,11 +4698,11 @@ | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968 | tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len); | - 1da7: lea -0x11(%rbx),%edx | + 1da7: lea -0x4(%rbx),%edx | 1daa: movzwl %bp,%eax | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969 | tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len; | - 1dad: lea 0x11(%r15,%rbp,1),%r15 | + 1dad: lea 0x4(%r15,%rbp,1),%r15 The above reflects the desired change: avoid counting 13 too many bytes; which is the total size of the double-counted members in `struct mwifiex_ie_types_rxba_sync`: $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o struct mwifiex_ie_types_rxba_sync { struct mwifiex_ie_types_header header; /* 0 4 */ |----------------------------------------------------------------------- | u8 mac[6]; /* 4 6 */ | | u8 tid; /* 10 1 */ | | u8 reserved; /* 11 1 */ | | __le16 seq_num; /* 12 2 */ | | __le16 bitmap_len; /* 14 2 */ | | u8 bitmap[1]; /* 16 1 */ | |----------------------------------------------------------------------| | 13 bytes| ----------- /* size: 17, cachelines: 1, members: 7 */ /* last cacheline: 17 bytes */ } __attribute__((__packed__)); Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/06668edd68e7a26bbfeebd1201ae077a2a7a8bce.1692931954.git.gustavoars@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit eec679e4ac5f47507774956fb3479c206e761af7 upstream.

In a TLV encoding scheme, the Length part represents the length after
the header containing the values for type and length. In this case,
`tlv_len` should be:

tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len

Notice that the `- 1` accounts for the one-element array `bitmap`, which
1-byte size is already included in `sizeof(*tlv_rxba)`.

So, if the above is correct, there is a double-counting of some members
in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
are calculated:

968                 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
969                 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);

in specific, members:

drivers/net/wireless/marvell/mwifiex/fw.h:777
 777         u8 mac[ETH_ALEN];
 778         u8 tid;
 779         u8 reserved;
 780         __le16 seq_num;
 781         __le16 bitmap_len;

This is clearly wrong, and affects the subsequent decoding of data in
`event_buf` through `tlv_rxba`:

970                 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;

Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
in the calculation of `tlv_buf_left` and `tmp`.

This results in the following binary differences before/after changes:

| drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
| @@ -4698,11 +4698,11 @@
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
|                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
| -    1da7:      lea    -0x11(%rbx),%edx
| +    1da7:      lea    -0x4(%rbx),%edx
|      1daa:      movzwl %bp,%eax
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
|                 tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
| -    1dad:      lea    0x11(%r15,%rbp,1),%r15
| +    1dad:      lea    0x4(%r15,%rbp,1),%r15

The above reflects the desired change: avoid counting 13 too many bytes;
which is the total size of the double-counted members in
`struct mwifiex_ie_types_rxba_sync`:

$ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
struct mwifiex_ie_types_rxba_sync {
	struct mwifiex_ie_types_header header;           /*     0     4 */

     |-----------------------------------------------------------------------
     |  u8                         mac[6];               /*     4     6 */  |
     |	u8                         tid;                  /*    10     1 */  |
     |  u8                         reserved;             /*    11     1 */  |
     | 	__le16                     seq_num;              /*    12     2 */  |
     | 	__le16                     bitmap_len;           /*    14     2 */  |
     |  u8                         bitmap[1];            /*    16     1 */  |
     |----------------------------------------------------------------------|
								  | 13 bytes|
								  -----------

	/* size: 17, cachelines: 1, members: 7 */
	/* last cacheline: 17 bytes */
} __attribute__((__packed__));

Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/06668edd68e7a26bbfeebd1201ae077a2a7a8bce.1692931954.git.gustavoars@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
wifi: rtw88: rtw8723d: Fix MAC address offset in EEPROM 2023-10-10T20:02:56+00:00 Sascha Hauer s.hauer@pengutronix.de 2023-09-07T07:16:14+00:00 9a32009321e992ab9651fb25762b230b424376c5 commit 2e1b3ae3e1f2cf5a3c9c05d5f961d7d4257b489f upstream. The MAC address is stored at offset 0x107 in the EEPROM, like correctly stated in the comment. Add a two bytes reserved field right before the MAC address to shift it from offset 0x105 to 0x107. With this the MAC address returned from my RTL8723du wifi stick can be correctly decoded as "Shenzhen Four Seas Global Link Network Technology Co., Ltd." Fixes: 87caeef032fc ("wifi: rtw88: Add rtw8723du chipset support") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Reported-by: Yanik Fuchs <Yanik.fuchs@mbv.ch> Cc: stable@vger.kernel.org Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230907071614.2032404-1-s.hauer@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 2e1b3ae3e1f2cf5a3c9c05d5f961d7d4257b489f upstream.

The MAC address is stored at offset 0x107 in the EEPROM, like correctly
stated in the comment. Add a two bytes reserved field right before the
MAC address to shift it from offset 0x105 to 0x107.

With this the MAC address returned from my RTL8723du wifi stick can be
correctly decoded as "Shenzhen Four Seas Global Link Network Technology
Co., Ltd."

Fixes: 87caeef032fc ("wifi: rtw88: Add rtw8723du chipset support")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Reported-by: Yanik Fuchs <Yanik.fuchs@mbv.ch>
Cc: stable@vger.kernel.org
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230907071614.2032404-1-s.hauer@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
wifi: brcmfmac: Replace 1-element arrays with flexible arrays 2023-10-10T20:02:56+00:00 Juerg Haefliger juerg.haefliger@canonical.com 2023-09-14T07:02:27+00:00 9a9c17c7c5548efcf6318987baa7099a13a9efd1 commit 4fed494abcd4fde5c24de19160e93814f912fdb3 upstream. Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"), UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking 'element' and 'channel_list' will trigger warnings, so make them proper flexible arrays. False positive warnings were: UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6984:20 index 1 is out of range for type '__le32 [1]' UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1126:27 index 1 is out of range for type '__le16 [1]' for these lines of code: 6884 ch.chspec = (u16)le32_to_cpu(list->element[i]); 1126 params_le->channel_list[i] = cpu_to_le16(chanspec); Cc: stable@vger.kernel.org # 6.5+ Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230914070227.12028-1-juerg.haefliger@canonical.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 4fed494abcd4fde5c24de19160e93814f912fdb3 upstream.

Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"),
UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking
'element' and 'channel_list' will trigger warnings, so make them proper
flexible arrays.

False positive warnings were:

  UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6984:20
  index 1 is out of range for type '__le32 [1]'

  UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1126:27
  index 1 is out of range for type '__le16 [1]'

for these lines of code:

  6884  ch.chspec = (u16)le32_to_cpu(list->element[i]);

  1126  params_le->channel_list[i] = cpu_to_le16(chanspec);

Cc: stable@vger.kernel.org # 6.5+
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230914070227.12028-1-juerg.haefliger@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>