linux.git/drivers/net/wireless, branch v4.13-rc4

brcmfmac: fix memleak due to calling brcmf_sdiod_sgtable_alloc() twice

2017-07-27T11:03:14+00:00

Due to a bugfix in wireless tree and the commit mentioned below a merge
was needed which went haywire. So the submitted change resulted in the
function brcmf_sdiod_sgtable_alloc() being called twice during the probe
thus leaking the memory of the first call.

Cc: stable@vger.kernel.org # 4.6.x
Fixes: 4d7928959832 ("brcmfmac: switch to new platform data")
Reported-by: Stefan Wahren 
Tested-by: Stefan Wahren 
Reviewed-by: Hante Meuleman 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo

brcmfmac: Don't grow SKB by negative size

2017-07-27T11:02:16+00:00

The commit to rework the headroom check in start_xmit() now calls
pxskb_expand_head() unconditionally if the header is CoW. Unfortunately,
it does so with the delta between the extant headroom and the header
length, which may be negative if there is already sufficient headroom.

pskb_expand_head() does allow for size being 0, in which case it just
copies, so clamp the header delta to zero.

Opening Chrome (and all my tabs) on a PCIE device was enough to reliably
hit this.

Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
Signed-off-by: Daniel Stone 
Cc: Arend Van Spriel 
Cc: James Hughes 
Cc: Hante Meuleman 
Cc: Pieter-Paul Giesberts 
Cc: Franky Lin 
Tested-by: Hans de Goede 
Signed-off-by: Kalle Valo

iwlwifi: mvm: defer setting IWL_MVM_STATUS_IN_HW_RESTART

2017-07-21T09:26:39+00:00

A hardware/firmware error may happen at any point in time. In
particular, it might happen while mac80211 is in the middle of
a flow. We observed the following situation:
 * mac80211 is in authentication flow, in ieee80211_prep_connection()
 * iwlwifi firmware crashes, but no error can be reported at this
   precise point (mostly because the driver method is void, but even
   if it wasn't we'd just shift to a race condition)
 * mac80211 continues the flow, trying to add the AP station
 * iwlwifi has already set its internal restart flag, and so thinks
   that adding the station is part of the restart and already set up,
   so it uses the information that's supposed to already be in the
   struct

This can happen with any flow in mac80211 and with any information
we try to preserve across hardware restarts.

To fix this, only set a new HW_RESTART_REQUESTED flag and translate
that to IN_HW_RESTART once mac80211 actually starts the restart by
calling our start() method. As a consequence, any mac80211 flow in
progress at the time of the restart will properly finish (certainly
with errors), before the restart is attempted.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195299.

Reported-by: djagoo 
Reported-by: Łukasz Siudut 
Signed-off-by: Johannes Berg 
Signed-off-by: Luca Coelho

iwlwifi: mvm: handle IBSS probe_queue in a few missing places

2017-07-21T09:26:39+00:00

When IBSS was implemented for DQA, we missid a few places where it
should be handled in the same way as AP.

Fixes: ee48b72211f8 ("iwlwifi: mvm: support ibss in dqa mode")
Signed-off-by: Luca Coelho

iwlwifi: fix tracing when tx only is enabled

2017-07-21T09:26:38+00:00

iwl_trace_data is somewhat confusing. It returns a bool
that tells if the payload of the skb should be added to
the tx_data event. If it returns false, then the payload
of the skb is added to the tx event.

The purpose is to be able to start tracing with
-e iwlwifi
and record non-data packets only which saves bandwidth.

Since EAPOLs are important, seldom and not real data
packet (despite being WiFi data packets), they are
included in tx event and thus iwl_trace_data returns false
on those. This last part was buggy, and because of that,
all the data packets were included in the tx event.

Fix that.

Fixes: 0c4cb7314d15 ("iwlwifi: tracing: decouple from mac80211")
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Luca Coelho

iwlwifi: missing error code in iwl_trans_pcie_alloc()

2017-07-21T09:26:38+00:00

We don't set the error code here so we end up returning ERR_PTR(0) which
is NULL.  The caller doesn't expect that so it results in a NULL
dereference.

Fixes: 2e5d4a8f61dc ("iwlwifi: pcie: Add new configuration to enable MSIX")
Signed-off-by: Dan Carpenter 
Signed-off-by: Luca Coelho

iwlwifi: mvm: fix a NULL pointer dereference of error in recovery

2017-07-21T09:26:37+00:00

Sometimes, we can have an firmware crash while trying to
recover from a previous firmware problem.
When that happens, lots of things can go wrong. For example
the stations don't get added properly to mvm->fw_id_to_mac_id.

Mac80211 tries to stop A-MPDU upon reconfig but in case of
a firmware crash we will bail out fairly early and in the
end, we won't delete the A-MPDU Rx timeout.
When that timer expired after a double firmware crash,
we end up dereferencing mvm->fw_id_to_mac_id[sta_id]
which is NULL.

Fixes: 10b2b2019d81 ("iwlwifi: mvm: add infrastructure for tracking BA session in driver")
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Luca Coelho

iwlwifi: pcie: fix unused txq NULL pointer dereference

2017-07-21T09:26:37+00:00

Before TVQM, all TX queues were allocated straight at init.
With TVQM, queues are allocated on demand and hence we need
to check if a queue exists before dereferencing it.

Fixes: 66128fa08806 ("iwlwifi: move to TVQM mode")
Signed-off-by: Mordechai Goodstein 
Signed-off-by: Luca Coelho

iwlwifi: dvm: prevent an out of bounds access

2017-07-21T09:26:36+00:00

iwlagn_check_ratid_empty takes the tid as a parameter, but
it doesn't check that it is not IWL_TID_NON_QOS.
Since IWL_TID_NON_QOS = 8 and iwl_priv::tid_data is an array
with 8 entries, accessing iwl_priv::tid_data[IWL_TID_NON_QOS]
is a bad idea.
This happened in iwlagn_rx_reply_tx. Since
iwlagn_check_ratid_empty is relevant only to check whether
we can open A-MPDU, this flow is irrelevant if tid is
IWL_TID_NON_QOS. Call iwlagn_check_ratid_empty only inside
the
	if (tid != IWL_TID_NON_QOS)

a few lines earlier in the function.

Cc: 
Reported-by: Seraphime Kirkovski 
Tested-by: Seraphime Kirkovski 
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Luca Coelho

Revert "rtlwifi: btcoex: rtl8723be: fix ant_sel not work"

2017-07-21T07:41:43+00:00

This reverts commit f95d95a7cd5514549dcf6ba754f0ee834cce3e1f.

With commit f95d95a7cd55 ("rtlwifi: btcoex: rtl8723be: fix ant_sel not
work"), the kernel has a NULL pointer dereference oops. This content and
the proper fix will be included in a later patch.

Fixes: f95d95a7cd55 ("rtlwifi: btcoex: rtl8723be: fix ant_sel not work")
Signed-off-by: Larry Finger 
Cc: Ping-Ke Shih 
Cc: Yan-Hsuan Chuang 
Cc: Birming Chiu 
Cc: Shaofu 
Cc: Steven Ting 
Signed-off-by: Kalle Valo