linux.git/drivers/net/wireless/rsi, branch v5.6

rsi_91x_usb: fix interface sanity check

2019-12-18T19:06:06+00:00

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Cc: stable      # 3.15
Cc: Fariya Fatima 
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo

rsi: add missing endpoint sanity checks

2019-12-18T18:57:07+00:00

The driver expects at least one bulk-in endpoint when in "wifi-alone"
operating mode and two bulk-in endpoints otherwise, and would otherwise
fail to to submit the corresponding bulk URB to the default pipe during
probe with a somewhat cryptic message:

	rsi_91x: rsi_rx_urb_submit: Failed in urb submission
	rsi_91x: rsi_probe: Failed in probe...Exiting
	RSI-USB WLAN: probe of 2-2.4:1.0 failed with error -8

The current endpoint sanity check looks broken and would only bail out
early if there was no bulk-in endpoint but at least one bulk-out
endpoint.

Tighten this check to always require at least one bulk-in and one
bulk-out endpoint, and add the missing sanity check for a Bluetooth
bulk-in endpoint when in a BT operating mode. Also make sure to log an
informative error message when the expected endpoints are missing.

Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo

rsi: fix non-atomic allocation in completion handler

2019-12-18T18:57:06+00:00

USB completion handlers are called in atomic context and must
specifically not allocate memory using GFP_KERNEL.

Fixes: a1854fae1414 ("rsi: improve RX packet handling in USB interface")
Cc: stable  # 4.17
Cc: Prameela Rani Garnepudi 
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo

rsi: fix memory leak on failed URB submission

2019-12-18T18:57:05+00:00

Make sure to free the skb on failed receive-URB submission (e.g. on
disconnect or currently also due to a missing endpoint).

Fixes: a1854fae1414 ("rsi: improve RX packet handling in USB interface")
Cc: stable      # 4.17
Cc: Prameela Rani Garnepudi 
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo

rsi: fix use-after-free on probe errors

2019-12-18T18:57:04+00:00

The driver would fail to stop the command timer in most error paths,
something which specifically could lead to the timer being freed while
still active on I/O errors during probe.

Fix this by making sure that each function starting the timer also stops
it in all relevant error paths.

Reported-by: syzbot+1d1597a5aa3679c65b9f@syzkaller.appspotmail.com
Fixes: b78e91bcfb33 ("rsi: Add new firmware loading method")
Cc: stable      # 4.12
Cc: Prameela Rani Garnepudi 
Cc: Amitkumar Karwar 
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo

rsi: fix use-after-free on failed probe and unbind

2019-12-18T18:57:03+00:00

Make sure to stop both URBs before returning after failed probe as well
as on disconnect to avoid use-after-free in the completion handler.

Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com
Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint")
Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Cc: stable      # 3.15
Cc: Siva Rebbagondla 
Cc: Prameela Rani Garnepudi 
Cc: Amitkumar Karwar 
Cc: Fariya Fatima 
Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo

Merge tag 'wireless-drivers-next-2019-11-05' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

2019-11-06T02:36:35+00:00

Kalle Valo says:

====================
wireless-drivers-next patches for 5.5

First set of patches for 5.5. The most active driver here clearly is
rtw88, lots of patches for it. More quiet on other drivers, smaller
fixes and cleanups all over.

This pull request also has a trivial conflict, the report and example
resolution here:

https://lkml.kernel.org/r/20191031111242.50ab1eca@canb.auug.org.au

Major changes:

rtw88

* add deep power save support

* add mac80211 software tx queue (wake_tx_queue) support

* enable hardware rate control

* add TX-AMSDU support

* add NL80211_EXT_FEATURE_CAN_REPLACE_PTK0 support

* add power tracking support

* add 802.11ac beamformee support

* add set_bitrate_mask support

* add phy_info debugfs to show Tx/Rx physical status

* add RFE type 3 support for 8822b

ath10k

* add support for hardware rfkill on devices where firmware supports it

rtl8xxxu

* add bluetooth co-existence support for single antenna

iwlwifi

* Revamp the debugging infrastructure
====================

Signed-off-by: David S. Miller

rsi: drop bogus device-id checks from probe

2019-10-09T08:23:46+00:00

USB core will never call a USB-driver probe function with a NULL
device-id pointer.

Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo

Revert "rsi: fix potential null dereference in rsi_probe()"

2019-10-09T08:23:45+00:00

This reverts commit f170d44bc4ec2feae5f6206980e7ae7fbf0432a0.

USB core will never call a USB-driver probe function with a NULL
device-id pointer.

Reverting before removing the existing checks in order to document this
and prevent the offending commit from being "autoselected" for stable.

Signed-off-by: Johan Hovold 
Signed-off-by: Kalle Valo

rsi: fix potential null dereference in rsi_probe()

2019-10-04T13:46:43+00:00

The id pointer can be NULL in rsi_probe(). It is checked everywhere except
for the else branch in the idProduct condition. The patch adds NULL check
before the id dereference in the rsi_dbg() call.

Fixes: 54fdb318c111 ("rsi: add new device model for 9116")
Cc: Amitkumar Karwar 
Cc: Siva Rebbagondla 
Cc: Kalle Valo 
Signed-off-by: Denis Efremov 
Signed-off-by: Kalle Valo