A couple of fixes:
* fix 160 MHz channel switch in mac80211
* fix a staging driver to not deadlock due to some
recent cfg80211 changes
* fix NULL-ptr deref if cfg80211 returns -EINPROGRESS
to wext (syzbot)
* pause TX in mac80211 in type change to prevent crashes
(syzbot)
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEH1e1rEeCd0AIMq6MB8qZga/fl8QFAmAQEXcACgkQB8qZga/f
l8SYWg//X01WgOAAu8mTbnXGdnHF/ZTssp+/eenmoc/XroJgMmvbt4b/gfSt0xMF
kEd3kPBPtp6Ttgr4HQAyfFctmtXcgq9qo6L8wBWy8WeDHBjaOMLWBLMlZ3m3/abH
oU8LvDNO0FYCf5qCIzmpFJYXlEsyv22XOi9GYx62ux5g7DbWO6C1Me3dn7im+IiW
+/P7Qy5lSDpww9F89wMfkwP4dDNcycgKkeRn6IEH1gJxzF6x6GFjuTvrr0finBnO
9m/zgZCbBm0VIdFcySiJUiWqyhDgdfa3dfcOtNwegkH8mZUZ+h8sEG67Ku4Hp56L
Js6AmOw4TA9kSs11nOWOZm9609kk8s8ucy88A8v7ct6O9FkxvzcK6VLo3GCGTBPE
8BsPJoL9OXvziT/vwuGPJDruO3Vv6yzoDf8cSiiMGCCOe5TPioucDSbU8QV4N02Q
OJ8NcgRtxIo0GC6DD8xOvafWVvc6/byruBpe1x7SkkgfK0NIaMKgWh2g8Ebi3RpE
H1X/2FpsZ7AgKDs2yfJs4oFOwL72o8WezH6jTM4AFoGOEtxPnrYaG1+R35y6R9Vp
DwPRo9bTyVb4rpnoOv/FYMoBaKpP7qQDyGlwvGeqUlAW8Yj+H+MmxVUv5JUIj4Cu
Zdy0bFq27dntJ+/jnoryFfU/afyOdkANAu9cmlx+vXqr1etLvww=
=g3wj
-----END PGP SIGNATURE-----
Merge tag 'mac80211-for-net-2021-01-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
Johannes Berg says:
====================
A couple of fixes:
* fix 160 MHz channel switch in mac80211
* fix a staging driver to not deadlock due to some
recent cfg80211 changes
* fix NULL-ptr deref if cfg80211 returns -EINPROGRESS
to wext (syzbot)
* pause TX in mac80211 in type change to prevent crashes
(syzbot)
* tag 'mac80211-for-net-2021-01-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211:
staging: rtl8723bs: fix wireless regulatory API misuse
mac80211: pause TX while changing interface type
wext: fix NULL-ptr-dereference with cfg80211's lack of commit()
mac80211: 160MHz with extended NSS BW in CSA
====================
Link: https://lore.kernel.org/r/20210126130529.75225-1-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski
commit
c5e9e8d48a
|
|
@ -20,9 +20,9 @@ enum country_code_type_t {
|
|||
COUNTRY_CODE_MAX
|
||||
};
|
||||
|
||||
int rtw_regd_init(struct adapter *padapter,
|
||||
void (*reg_notifier)(struct wiphy *wiphy,
|
||||
struct regulatory_request *request));
|
||||
void rtw_regd_init(struct wiphy *wiphy,
|
||||
void (*reg_notifier)(struct wiphy *wiphy,
|
||||
struct regulatory_request *request));
|
||||
void rtw_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request);
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -3211,9 +3211,6 @@ void rtw_cfg80211_init_wiphy(struct adapter *padapter)
|
|||
rtw_cfg80211_init_ht_capab(&bands->ht_cap, NL80211_BAND_2GHZ, rf_type);
|
||||
}
|
||||
|
||||
/* init regulary domain */
|
||||
rtw_regd_init(padapter, rtw_reg_notifier);
|
||||
|
||||
/* copy mac_addr to wiphy */
|
||||
memcpy(wiphy->perm_addr, padapter->eeprompriv.mac_addr, ETH_ALEN);
|
||||
|
||||
|
|
@ -3328,6 +3325,9 @@ int rtw_wdev_alloc(struct adapter *padapter, struct device *dev)
|
|||
*((struct adapter **)wiphy_priv(wiphy)) = padapter;
|
||||
rtw_cfg80211_preinit_wiphy(padapter, wiphy);
|
||||
|
||||
/* init regulary domain */
|
||||
rtw_regd_init(wiphy, rtw_reg_notifier);
|
||||
|
||||
ret = wiphy_register(wiphy);
|
||||
if (ret < 0) {
|
||||
DBG_8192C("Couldn't register wiphy device\n");
|
||||
|
|
|
|||
|
|
@ -139,15 +139,11 @@ static void _rtw_regd_init_wiphy(struct rtw_regulatory *reg,
|
|||
_rtw_reg_apply_flags(wiphy);
|
||||
}
|
||||
|
||||
int rtw_regd_init(struct adapter *padapter,
|
||||
void (*reg_notifier)(struct wiphy *wiphy,
|
||||
struct regulatory_request *request))
|
||||
void rtw_regd_init(struct wiphy *wiphy,
|
||||
void (*reg_notifier)(struct wiphy *wiphy,
|
||||
struct regulatory_request *request))
|
||||
{
|
||||
struct wiphy *wiphy = padapter->rtw_wdev->wiphy;
|
||||
|
||||
_rtw_regd_init_wiphy(NULL, wiphy, reg_notifier);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void rtw_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
|
||||
|
|
|
|||
|
|
@ -1078,6 +1078,7 @@ enum queue_stop_reason {
|
|||
IEEE80211_QUEUE_STOP_REASON_FLUSH,
|
||||
IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN,
|
||||
IEEE80211_QUEUE_STOP_REASON_RESERVE_TID,
|
||||
IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE,
|
||||
|
||||
IEEE80211_QUEUE_STOP_REASONS,
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1617,6 +1617,10 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
|
|||
if (ret)
|
||||
return ret;
|
||||
|
||||
ieee80211_stop_vif_queues(local, sdata,
|
||||
IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
|
||||
synchronize_net();
|
||||
|
||||
ieee80211_do_stop(sdata, false);
|
||||
|
||||
ieee80211_teardown_sdata(sdata);
|
||||
|
|
@ -1639,6 +1643,8 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
|
|||
err = ieee80211_do_open(&sdata->wdev, false);
|
||||
WARN(err, "type change: do_open returned %d", err);
|
||||
|
||||
ieee80211_wake_vif_queues(local, sdata,
|
||||
IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -133,16 +133,20 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
|
|||
}
|
||||
|
||||
if (wide_bw_chansw_ie) {
|
||||
u8 new_seg1 = wide_bw_chansw_ie->new_center_freq_seg1;
|
||||
struct ieee80211_vht_operation vht_oper = {
|
||||
.chan_width =
|
||||
wide_bw_chansw_ie->new_channel_width,
|
||||
.center_freq_seg0_idx =
|
||||
wide_bw_chansw_ie->new_center_freq_seg0,
|
||||
.center_freq_seg1_idx =
|
||||
wide_bw_chansw_ie->new_center_freq_seg1,
|
||||
.center_freq_seg1_idx = new_seg1,
|
||||
/* .basic_mcs_set doesn't matter */
|
||||
};
|
||||
struct ieee80211_ht_operation ht_oper = {};
|
||||
struct ieee80211_ht_operation ht_oper = {
|
||||
.operation_mode =
|
||||
cpu_to_le16(new_seg1 <<
|
||||
IEEE80211_HT_OP_MODE_CCFS2_SHIFT),
|
||||
};
|
||||
|
||||
/* default, for the case of IEEE80211_VHT_CHANWIDTH_USE_HT,
|
||||
* to the previously parsed chandef
|
||||
|
|
|
|||
|
|
@ -896,8 +896,9 @@ out:
|
|||
int call_commit_handler(struct net_device *dev)
|
||||
{
|
||||
#ifdef CONFIG_WIRELESS_EXT
|
||||
if ((netif_running(dev)) &&
|
||||
(dev->wireless_handlers->standard[0] != NULL))
|
||||
if (netif_running(dev) &&
|
||||
dev->wireless_handlers &&
|
||||
dev->wireless_handlers->standard[0])
|
||||
/* Call the commit handler on the driver */
|
||||
return dev->wireless_handlers->standard[0](dev, NULL,
|
||||
NULL, NULL);
|
||||
|
|
|
|||
Loading…
Reference in a new issue