kernel/linux.git/drivers/net/wireless/mediatek, branch v4.19.112

mt76: fix array overflow on receiving too many fragments for a packet

2020-03-18T06:14:22+00:00

commit b102f0c522cf668c8382c56a4f771b37d011cda2 upstream. If the hardware receives an oversized packet with too many rx fragments, skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages. This becomes especially visible if it corrupts the freelist pointer of a slab page. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman

mt76: usb: fix possible memory leak in mt76u_buf_free

2020-01-27T13:50:23+00:00

[ Upstream commit cb83585e1121bd6d6c039cf09fa32380bf8b6258 ] Move q->ndesc initialization before the for loop in mt76u_alloc_rx since otherwise allocated urbs will not be freed in mt76u_buf_free Double-check scatterlist pointer in mt76u_buf_free Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin

mt7601u: fix bbp version check in mt7601u_wait_bbp_ready

2020-01-27T13:49:52+00:00

commit 15e14f76f85f4f0eab3b8146e1cd3c58ce272823 upstream. Fix bbp ready check in mt7601u_wait_bbp_ready. The issue is reported by coverity with the following error: Logical vs. bitwise operator The expression's value does not depend on the operands; inadvertent use of the wrong operator is a likely logic error. Addresses-Coverity-ID: 1309441 ("Logical vs. bitwise operator") Fixes: c869f77d6abb ("add mt7601u driver") Acked-by: Jakub Kicinski Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman

mt76x0: phy: fix restore phase in mt76x0_phy_recalibrate_after_assoc

2019-12-01T08:16:19+00:00

[ Upstream commit 4df942733fd26d9378a4a00619be348c771e0190 ] Fix restore value configured in MT_BBP(IBI, 9) register in mt76x0_phy_recalibrate_after_assoc routine. Fixes: 10de7a8b4ab9 ("mt76x0: phy files") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin

mt76: do not store aggregation sequence number for null-data frames

2019-12-01T08:16:18+00:00

[ Upstream commit 5155938d8a0fe0e0251435cae02539e81fb8e407 ] Fixes a rare corner case where a BlockAckReq might get the wrong sequence number. Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin

mt76: fix handling ps-poll frames

2019-11-24T07:19:29+00:00

[ Upstream commit 36d910960fae3f9e74bedf3e0ef39ee26bdaa51f ] Hardware station lookup for pspoll frames can fail, which makes the driver ignore ps-poll frames. Fix the resulting powersave issues by looking up the station for pspoll frames in software Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin

mt76x2: disable WLAN core before probe

2019-11-24T07:19:29+00:00

[ Upstream commit 62e04f8a31fcc375c978b7f83b4229a10c3e746d ] If the WLAN core is still active during initialization, it might cause the MCU or DMA to hang. This can happen during soft reboot, so disable the core + clock early to avoid this issue. Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin

mt76x2: fix tx power configuration for VHT mcs 9

2019-11-24T07:19:28+00:00

[ Upstream commit 60b6645ef1a9239a02c70adeae136298395d145a ] Fix tx power configuration for VHT 1SS/STBC mcs 9 since in MT_TX_PWR_CFG_{8,9} mcs 8,9 bits are GENMASK(21,16) and GENMASK(29,24) while GENMASK(15,6) are marked as reserved Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin

mt76: Fix comparisons with invalid hardware key index

2019-11-20T17:45:49+00:00

[ Upstream commit 81c8eccc2404d06082025b773f1d90e8c861bc6a ] With gcc 4.1.2: drivers/net/wireless/mediatek/mt76/mt76x0/tx.c: In function ‘mt76x0_tx’: drivers/net/wireless/mediatek/mt76/mt76x0/tx.c:169: warning: comparison is always true due to limited range of data type drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c: In function ‘mt76x2_tx’: drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c:35: warning: comparison is always true due to limited range of data type While assigning -1 to a u8 works fine, comparing with -1 does not work as expected. Fix this by comparing with 0xff, like is already done in some other places. Signed-off-by: Geert Uytterhoeven Signed-off-by: Kalle Valo Signed-off-by: Sasha Levin

mt76: fix corrupted software generated tx CCMP PN

2019-09-16T06:22:06+00:00

[ Upstream commit 906d2d3f874a54183df5a609fda180adf0462428 ] Since ccmp_pn is u8 *, the second half needs to start at array index 4 instead of 0. Fixes a connection stall after a certain amount of traffic Fixes: 23405236460b9 ("mt76: fix transmission of encrypted management frames") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin