summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/ath/ath10k/usb.c
AgeCommit message (Collapse)AuthorFilesLines
2021-11-18ath10k: fix division by zero in send pathJohan Hovold1-0/+5
commit a006acb931317aad3a8dd41333ebb0453caf49b8 upstream. Add the missing endpoint max-packet sanity check to probe() to avoid division by zero in ath10k_usb_hif_tx_sg() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Fixes: 4db66499df91 ("ath10k: add initial USB support") Cc: stable@vger.kernel.org # 4.14 Cc: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211027080819.6675-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-18ath10k: fix control-message timeoutJohan Hovold1-1/+1
commit 5286132324230168d3fab6ffc16bfd7de85bdfb4 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 4db66499df91 ("ath10k: add initial USB support") Cc: stable@vger.kernel.org # 4.14 Cc: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211025120522.6045-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30ath10k: Release some resources in an error handling pathChristophe JAILLET1-1/+4
[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ] Should an error occur after calling 'ath10k_usb_create()', it should be undone by a corresponding 'ath10k_usb_destroy()' call Fixes: 4db66499df91 ("ath10k: add initial USB support") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30ath10k: Fix an error handling pathChristophe JAILLET1-0/+2
[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ] If 'ath10k_usb_create()' fails, we should release some resources and report an error instead of silently continuing. Fixes: 4db66499df91 ("ath10k: add initial USB support") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-07-15wireless: Fix trivial spellingKieran Bingham1-1/+1
The word 'descriptor' is misspelled throughout the tree. Fix it up accordingly: decriptors -> descriptors Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200715124839.252822-5-kieran.bingham+renesas@ideasonboard.com
2020-04-21ath10k: hif: make send_complete_check op optionalKalle Valo1-12/+0
That way we don't need to have an empty function in sdio.c. No functional changes, compile tested only. Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/1587037859-28873-5-git-send-email-kvalo@codeaurora.org
2019-10-22ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipeHui Peng1-0/+8
The `ar_usb` field of `ath10k_usb_pipe_usb_pipe` objects are initialized to point to the containing `ath10k_usb` object according to endpoint descriptors read from the device side, as shown below in `ath10k_usb_setup_pipe_resources`: for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { endpoint = &iface_desc->endpoint[i].desc; // get the address from endpoint descriptor pipe_num = ath10k_usb_get_logical_pipe_num(ar_usb, endpoint->bEndpointAddress, &urbcount); ...... // select the pipe object pipe = &ar_usb->pipes[pipe_num]; // initialize the ar_usb field pipe->ar_usb = ar_usb; } The driver assumes that the addresses reported in endpoint descriptors from device side to be complete. If a device is malicious and does not report complete addresses, it may trigger NULL-ptr-deref `ath10k_usb_alloc_urb_from_pipe` and `ath10k_usb_free_urb_to_pipe`. This patch fixes the bug by preventing potential NULL-ptr-deref. Signed-off-by: Hui Peng <benquike@gmail.com> Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [groeck: Add driver tag to subject, fix build warning] Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-23ath10k: fix memory leakNavid Emamdoost1-0/+1
In ath10k_usb_hif_tx_sg the allocated urb should be released if usb_submit_urb fails. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-06-25ath10k: Change the warning message stringFabio Estevam1-1/+1
The "WARNING" string confuses syzbot, which thinks it found a crash [1]. Change the string to avoid such problem. [1] https://lkml.org/lkml/2019/5/9/243 Reported-by: syzbot+c1b25598aa60dcd47e78@syzkaller.appspotmail.com Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Fabio Estevam <festevam@gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: initialise struct ath10k_bus params to zeroKalle Valo1-1/+1
This way we don't need to set every variable and give them to default, which is zero. This is also safer in case we forgot to initalise a new field in some of the bus modules. Compile tested only. Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-20ath10k: switch to use SPDX license identifiersKalle Valo1-12/+1
Use SPDX identifiers everywhere in ath10k. Makefile was incorrectly marked in commit b24413180f56 ("License cleanup: add SPDX GPL-2.0 license identifier to files with no license"), fix that as well. Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-11ath10k: enable Factory Test Mode for WCN3990Rakesh Pillai1-1/+2
The support to put WCN3990 firmware into Factory test mode is not present currently. The WCN3990 firmware can operate in Factory test mode based on the mode it receives in the wlan enable message from the host driver. When the host driver is started in testmode send the operating mode as UTF mode, to the WCN3990 firmware, in the wlan enable message to start the firmware in Factory test mode. Tested on: WCN3990 Tested FW: WLAN.HL.2.0-01192-QCAHLSWMTPLZ-1. Signed-off-by: Rakesh Pillai <pillair@codeaurora.org> Reviewed-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-09-06ath10k: add device type enum to ath10k_bus_paramsErik Stromdahl1-0/+1
Add dev_type parameter to struct ath10k_bus_params. The dev type specifies if the device is a high latency device (usb and sdio) or low latency device (pci, ahb and snoc) The setup of high latency chips is sometimes different than for chips using low latency interfaces. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-09-06ath10k: add struct ath10k_bus_paramsErik Stromdahl1-3/+3
This struct is used as argument to ath10k_core_register in order to make it easier to add more bus parameters in the future. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03ath10k: add initial USB supportErik Stromdahl1-0/+1106
Chipsets like QCA9377 have support for USB so add initial USB bus support to ath10k. With this patch we have the low level HIF and HTC protocol working and it's possible to boot the firmware, but it's still not possible to connect or anything like. More changes are needed for full functionality. For that reason we print during initialisation: WARNING: ath10k USB support is incomplete, don't expect anything to work! Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
generated by cgit v1.2.3 (git 2.39.0) at 2025-02-06 18:33:45 +0300