kernel/linux.git/drivers/net/wireless/intel, branch v6.13.6

wifi: iwlwifi: avoid memory leak

2025-02-17T10:36:03+00:00

[ Upstream commit 80e96206a3ef348fbd658d98f2f43149c36df8bc ] A caller of iwl_acpi_get_dsm_object must free the returned object. iwl_acpi_get_dsm_integer returns immediately without freeing it if the expected size is more than 8 bytes. Fix that. Note that with the current code this will never happen, since the caller of iwl_acpi_get_dsm_integer already checks that the expected size if either 1 or 4 bytes, so it can't exceed 8 bytes. While at it, print the DSM value instead of the return value, as this was the intention in the first place. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20241228223206.bf61eaab99f8.Ibdc5df02f885208c222456d42c889c43b7e3b2f7@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: iwlwifi: pcie: Add support for new device ids

2025-02-17T10:36:03+00:00

[ Upstream commit 9b45ba3976945e8d53f2dd40541a66c690f12286 ] Add support for new device-ids 0x2730 and 0x272F. Signed-off-by: Somashekhar(Som) Reviewed-by: Johannes Berg Link: https://patch.msgid.link/20241226174257.6a0db60436e7.I50a66544dde6c88acd9abe4b31badab96ef04cfc@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: iwlwifi: mvm: remove unneeded NULL pointer checks

2025-02-08T09:01:17+00:00

[ Upstream commit 79f4b6934dbd7dd6741726ba004a15e25380b8cc ] Smatch reported that we dereference the data pointer to calculate the expected length before we check it's not NULL. While this is true (and hence needs to be fixed), this will never happen because the data pointer comes from struct iwl_rx_packet object which has the following layout: struct iwl_rx_packet { __le32 len_n_flags; struct iwl_cmd_header hdr; u8 data[]; } __packed; So, if the pointer to iwl_rx_packet is valid, data will be valid as well. Remove the NULL pointer check on 'data' to avoid confusing smatch. Also remove the check from similar functions in the same flow that were cargo cult copy-pasted. Fixes: 4635e6eaa0fe ("wifi: iwlwifi: mvm: support new versions of the wowlan APIs") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202411210812.0eLaonw3-lkp@intel.com/ Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20241229164246.c8ce6e041e4b.I4dc19289e3f3807386768c846e08be3ea322cd15@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: iwlwifi: mvm: don't count mgmt frames as MPDU

2025-02-08T09:01:17+00:00

[ Upstream commit 76260267ba26a6e513acefa5e7de1200fbeb5b5d ] When handling TX_CMD notification, for mgmt frames tid is equal to IWL_MAX_TID_COUNT, so with the current logic we'll count that as MPDU, fix that. Fixes: ec0d43d26f2c ("wifi: iwlwifi: mvm: Activate EMLSR based on traffic volume") Signed-off-by: Daniel Gabay Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20241229164246.80b119bb5d08.I31b1e8ba25cce15819225e5ac80332e4eaa20c13@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: iwlwifi: mvm: avoid NULL pointer dereference

2025-02-08T09:01:17+00:00

[ Upstream commit cf704a7624f99eb2ffca1a16c69183e85544a613 ] When iterating over the links of a vif, we need to make sure that the pointer is valid (in other words - that the link exists) before dereferncing it. Use for_each_vif_active_link that also does the check. Fixes: 2b7ee1a10a72 ("wifi: iwlwiif: mvm: handle the new BT notif") Signed-off-by: Miri Korenblit Reviewed-by: Emmanuel Grumbach Link: https://patch.msgid.link/20241229164246.31d41f7d3eab.I7fb7036a0b187c1636b01970207259cb2327952c@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: iwlwifi: fw: read STEP table from correct UEFI var

2025-02-08T09:01:17+00:00

[ Upstream commit 80c2b651fe7fc82e1d1b3e4f9651095896a095f0 ] This variable exists for the "common" (WiFi/BT) GUID, not the WiFi-only GUID. Fix that by passing the GUID to the function. A short-cut for the wifi-only version remains so not all code must be updated. However, rename the GUID defines to be clearer. Fixes: 09b4c35d73a5 ("wifi: iwlwifi: mvm: Support STEP equalizer settings from BIOS.") Signed-off-by: Johannes Berg Reviewed-by: Daniel Gabay Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20241227095718.89a5ad921b6d.Idae95a70ff69d2ba1b610e8eced826961ce7de98@changeid Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*

2024-12-18T17:34:57+00:00

Both struct cfg80211_wowlan_nd_match and struct cfg80211_wowlan_nd_info pre-allocate space for channels and matches, but then may end up using fewer that the full allocation. Shrink the associated counter (n_channels and n_matches) after counting the results. This avoids compile-time (and run-time) warnings from __counted_by. (The counter member needs to be updated _before_ accessing the array index.) Seen with coming GCC 15: drivers/net/wireless/intel/iwlwifi/mvm/d3.c: In function 'iwl_mvm_query_set_freqs': drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2877:66: warning: operation on 'match->n_channels' may be undefined [-Wsequence-point] 2877 | match->channels[match->n_channels++] = | ~~~~~~~~~~~~~~~~~^~ drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2885:66: warning: operation on 'match->n_channels' may be undefined [-Wsequence-point] 2885 | match->channels[match->n_channels++] = | ~~~~~~~~~~~~~~~~~^~ drivers/net/wireless/intel/iwlwifi/mvm/d3.c: In function 'iwl_mvm_query_netdetect_reasons': drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2982:58: warning: operation on 'net_detect->n_matches' may be undefined [-Wsequence-point] 2982 | net_detect->matches[net_detect->n_matches++] = match; | ~~~~~~~~~~~~~~~~~~~~~^~ Cc: stable@vger.kernel.org Fixes: aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate") Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://patch.msgid.link/20240619211233.work.355-kees@kernel.org Signed-off-by: Johannes Berg

wifi: iwlwifi: fix CRF name for Bz

2024-12-13T12:39:17+00:00

We had BE201 hard coded. Look at the RF_ID and decide based on its value. Fixes: 6795a37161fb ("wifi: iwlwifi: Print a specific device name.") Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20241212132940.b9eebda1ca60.I36791a134ed5e538e059418eb6520761da97b44c@changeid Signed-off-by: Johannes Berg

Merge tag 'wireless-2024-12-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

2024-12-11T02:44:25+00:00

Johannes Berg says: ==================== A small set of fixes: - avoid CSA warnings during link removal (by changing link bitmap after remove) - fix # of spatial streams initialisation - fix queues getting stuck in some CSA cases and resume failures - fix interface address when switching monitor mode - fix MBSS change flags 32-bit stack corruption - more UBSAN __counted_by "fixes" ... - fix link ID netlink validation * tag 'wireless-2024-12-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211: sme: init n_channels before channels[] access wifi: mac80211: fix station NSS capability initialization order wifi: mac80211: fix vif addr when switching from monitor to station wifi: mac80211: fix a queue stall in certain cases of CSA wifi: mac80211: wake the queues in case of failure in resume wifi: cfg80211: clear link ID from bitmap during link delete after clean up wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon wifi: mac80211: fix mbss changed flags corruption on 32 bit systems wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one ==================== Link: https://patch.msgid.link/20241210130145.28618-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski

wifi: mac80211: fix a queue stall in certain cases of CSA

2024-12-03T10:28:34+00:00

If we got an unprotected action frame with CSA and then we heard the beacon with the CSA IE, we'll block the queues with the CSA reason twice. Since this reason is refcounted, we won't wake up the queues since we wake them up only once and the ref count will never reach 0. This led to blocked queues that prevented any activity (even disconnection wouldn't reset the queue state and the only way to recover would be to reload the kernel module. Fix this by not refcounting the CSA reason. It becomes now pointless to maintain the csa_blocked_queues state. Remove it. Signed-off-by: Emmanuel Grumbach Fixes: 414e090bc41d ("wifi: mac80211: restrict public action ECSA frame handling") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219447 Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20241119173108.5ea90828c2cc.I4f89e58572fb71ae48e47a81e74595cac410fbac@changeid Signed-off-by: Johannes Berg