From: Hauke Mehrtens Date: Fri, 15 Feb 2019 17:43:55 +0000 (+0100) Subject: mac80211: update to version 4.19.23-1 X-Git-Tag: v19.07.0-rc1~1287 X-Git-Url: http://git.openwrt.org/?a=commitdiff_plain;ds=sidebyside;h=d48a8ed40d3d1b65eec9c848828c6c0e2928cf07;p=openwrt%2Fopenwrt.git mac80211: update to version 4.19.23-1 This updates mac80211 to backports version 4.19.23-1 which includes all the stable fixes from kernel 4.19.23. The removed patches are included in this version. Signed-off-by: Hauke Mehrtens --- diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile index 48ec5f1c49..a13ef41193 100644 --- a/package/kernel/mac80211/Makefile +++ b/package/kernel/mac80211/Makefile @@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=mac80211 -PKG_VERSION:=4.19.7-1 -PKG_RELEASE:=2 -PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v4.19.7/ -PKG_HASH:=86650a02f36b0d39059be343d4bad3be14adece699723713a69c94cc64d456ef +PKG_VERSION:=4.19.23-1 +PKG_RELEASE:=1 +PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v4.19.23/ +PKG_HASH:=703e940b542eb56067fcd847a7c69398dcc9829f34472647eea4211cb2ab3b83 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION) diff --git a/package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch b/package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch index 777b73417f..d5c37825fd 100644 --- a/package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch +++ b/package/kernel/mac80211/patches/ath/381-ath9k-fix-tx99-with-monitor-mode-interface.patch @@ -81,7 +81,7 @@ Signed-off-by: Felix Fietkau rate->flags |= IEEE80211_TX_RC_MCS; --- a/drivers/net/wireless/ath/ath9k/xmit.c +++ b/drivers/net/wireless/ath/ath9k/xmit.c -@@ -2973,7 +2973,7 @@ int ath9k_tx99_send(struct ath_softc *sc +@@ -2974,7 +2974,7 @@ int ath9k_tx99_send(struct ath_softc *sc return -EINVAL; } diff --git a/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch b/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch index abd0fdc210..7f30de9862 100644 --- a/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch +++ b/package/kernel/mac80211/patches/ath/395-ath9k-add-back-support-for-using-active-monitor-inte.patch @@ -85,7 +85,7 @@ Signed-off-by: Felix Fietkau rate->flags |= IEEE80211_TX_RC_MCS; --- a/drivers/net/wireless/ath/ath9k/xmit.c +++ b/drivers/net/wireless/ath/ath9k/xmit.c -@@ -2973,7 +2973,7 @@ int ath9k_tx99_send(struct ath_softc *sc +@@ -2974,7 +2974,7 @@ int ath9k_tx99_send(struct ath_softc *sc return -EINVAL; } diff --git a/package/kernel/mac80211/patches/ath/553-ath9k-dynack-use-authentication-messages-for-late-ac.patch b/package/kernel/mac80211/patches/ath/553-ath9k-dynack-use-authentication-messages-for-late-ac.patch deleted file mode 100644 index 831c534762..0000000000 --- a/package/kernel/mac80211/patches/ath/553-ath9k-dynack-use-authentication-messages-for-late-ac.patch +++ /dev/null @@ -1,27 +0,0 @@ -From: Lorenzo Bianconi -Date: Fri, 2 Nov 2018 21:49:55 +0100 -Subject: [PATCH] ath9k: dynack: use authentication messages for 'late' ack - -In order to properly support dynack in ad-hoc mode running -wpa_supplicant, take into account authentication frames for -'late ack' detection. This patch has been tested on devices -mounted on offshore high-voltage stations connected through -~24Km link - -Reported-by: Koen Vandeputte -Tested-by: Koen Vandeputte -Signed-off-by: Lorenzo Bianconi ---- - ---- a/drivers/net/wireless/ath/ath9k/dynack.c -+++ b/drivers/net/wireless/ath/ath9k/dynack.c -@@ -187,7 +187,8 @@ void ath_dynack_sample_tx_ts(struct ath_ - /* late ACK */ - if (ts->ts_status & ATH9K_TXERR_XRETRY) { - if (ieee80211_is_assoc_req(hdr->frame_control) || -- ieee80211_is_assoc_resp(hdr->frame_control)) { -+ ieee80211_is_assoc_resp(hdr->frame_control) || -+ ieee80211_is_auth(hdr->frame_control)) { - ath_dbg(common, DYNACK, "late ack\n"); - ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2); - ath9k_hw_set_ack_timeout(ah, LATEACK_TO); diff --git a/package/kernel/mac80211/patches/ath/554-ath9k-dynack-move-debug-log-after-buffer-increments.patch b/package/kernel/mac80211/patches/ath/554-ath9k-dynack-move-debug-log-after-buffer-increments.patch index a1d612660b..607722cc3d 100644 --- a/package/kernel/mac80211/patches/ath/554-ath9k-dynack-move-debug-log-after-buffer-increments.patch +++ b/package/kernel/mac80211/patches/ath/554-ath9k-dynack-move-debug-log-after-buffer-increments.patch @@ -12,9 +12,9 @@ Signed-off-by: Lorenzo Bianconi --- a/drivers/net/wireless/ath/ath9k/dynack.c +++ b/drivers/net/wireless/ath/ath9k/dynack.c -@@ -171,11 +171,12 @@ static void ath_dynack_compute_to(struct - void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb, - struct ath_tx_status *ts) +@@ -178,11 +178,12 @@ void ath_dynack_sample_tx_ts(struct ath_ + struct ath_tx_status *ts, + struct ieee80211_sta *sta) { - u8 ridx; struct ieee80211_hdr *hdr; @@ -24,9 +24,9 @@ Signed-off-by: Lorenzo Bianconi + u32 dur = ts->duration; + u8 ridx; - if ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !da->enabled) + if (!da->enabled || (info->flags & IEEE80211_TX_CTL_NO_ACK)) return; -@@ -203,14 +204,13 @@ void ath_dynack_sample_tx_ts(struct ath_ +@@ -217,14 +218,13 @@ void ath_dynack_sample_tx_ts(struct ath_ ridx = ts->ts_rateindex; da->st_rbf.ts[da->st_rbf.t_rb].tstamp = ts->ts_tstamp; @@ -42,7 +42,7 @@ Signed-off-by: Lorenzo Bianconi rate = &common->sbands[info->band].bitrates[rates[ridx].idx]; if (info->band == NL80211_BAND_2GHZ && -@@ -219,19 +219,18 @@ void ath_dynack_sample_tx_ts(struct ath_ +@@ -233,19 +233,18 @@ void ath_dynack_sample_tx_ts(struct ath_ else phy = WLAN_RC_PHY_OFDM; @@ -68,7 +68,7 @@ Signed-off-by: Lorenzo Bianconi ath_dynack_compute_to(ah); spin_unlock_bh(&da->qlock); -@@ -258,14 +257,13 @@ void ath_dynack_sample_ack_ts(struct ath +@@ -272,14 +271,13 @@ void ath_dynack_sample_ack_ts(struct ath spin_lock_bh(&da->qlock); da->ack_rbf.tstamp[da->ack_rbf.t_rb] = ts; diff --git a/package/kernel/mac80211/patches/ath/555-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch b/package/kernel/mac80211/patches/ath/555-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch deleted file mode 100644 index cc5cdf9233..0000000000 --- a/package/kernel/mac80211/patches/ath/555-ath9k-dynack-check-da-enabled-first-in-sampling-rout.patch +++ /dev/null @@ -1,33 +0,0 @@ -From: Lorenzo Bianconi -Date: Fri, 2 Nov 2018 21:49:57 +0100 -Subject: [PATCH] ath9k: dynack: check da->enabled first in sampling - routines - -Check da->enabled flag first in ath_dynack_sample_tx_ts and -ath_dynack_sample_ack_ts routines in order to avoid useless -processing - -Tested-by: Koen Vandeputte -Signed-off-by: Lorenzo Bianconi ---- - ---- a/drivers/net/wireless/ath/ath9k/dynack.c -+++ b/drivers/net/wireless/ath/ath9k/dynack.c -@@ -178,7 +178,7 @@ void ath_dynack_sample_tx_ts(struct ath_ - u32 dur = ts->duration; - u8 ridx; - -- if ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !da->enabled) -+ if (!da->enabled || (info->flags & IEEE80211_TX_CTL_NO_ACK)) - return; - - spin_lock_bh(&da->qlock); -@@ -251,7 +251,7 @@ void ath_dynack_sample_ack_ts(struct ath - struct ath_common *common = ath9k_hw_common(ah); - struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; - -- if (!ath_dynack_bssidmask(ah, hdr->addr1) || !da->enabled) -+ if (!da->enabled || !ath_dynack_bssidmask(ah, hdr->addr1)) - return; - - spin_lock_bh(&da->qlock); diff --git a/package/kernel/mac80211/patches/ath/556-ath9k-dynack-make-ewma-estimation-faster.patch b/package/kernel/mac80211/patches/ath/556-ath9k-dynack-make-ewma-estimation-faster.patch deleted file mode 100644 index aaae8babcc..0000000000 --- a/package/kernel/mac80211/patches/ath/556-ath9k-dynack-make-ewma-estimation-faster.patch +++ /dev/null @@ -1,139 +0,0 @@ -From: Lorenzo Bianconi -Date: Fri, 2 Nov 2018 21:49:58 +0100 -Subject: [PATCH] ath9k: dynack: make ewma estimation faster - -In order to make propagation time estimation faster, -use current sample as ewma output value during 'late ack' -tracking - -Tested-by: Koen Vandeputte -Signed-off-by: Lorenzo Bianconi ---- - ---- a/drivers/net/wireless/ath/ath9k/ath9k.h -+++ b/drivers/net/wireless/ath/ath9k/ath9k.h -@@ -274,7 +274,7 @@ struct ath_node { - #endif - u8 key_idx[4]; - -- u32 ackto; -+ int ackto; - struct list_head list; - }; - ---- a/drivers/net/wireless/ath/ath9k/dynack.c -+++ b/drivers/net/wireless/ath/ath9k/dynack.c -@@ -29,9 +29,13 @@ - * ath_dynack_ewma - EWMA (Exponentially Weighted Moving Average) calculation - * - */ --static inline u32 ath_dynack_ewma(u32 old, u32 new) -+static inline int ath_dynack_ewma(int old, int new) - { -- return (new * (EWMA_DIV - EWMA_LEVEL) + old * EWMA_LEVEL) / EWMA_DIV; -+ if (old > 0) -+ return (new * (EWMA_DIV - EWMA_LEVEL) + -+ old * EWMA_LEVEL) / EWMA_DIV; -+ else -+ return new; - } - - /** -@@ -82,10 +86,10 @@ static inline bool ath_dynack_bssidmask( - */ - static void ath_dynack_compute_ackto(struct ath_hw *ah) - { -- struct ath_node *an; -- u32 to = 0; -- struct ath_dynack *da = &ah->dynack; - struct ath_common *common = ath9k_hw_common(ah); -+ struct ath_dynack *da = &ah->dynack; -+ struct ath_node *an; -+ int to = 0; - - list_for_each_entry(an, &da->nodes, list) - if (an->ackto > to) -@@ -144,7 +148,8 @@ static void ath_dynack_compute_to(struct - an->ackto = ath_dynack_ewma(an->ackto, - ackto); - ath_dbg(ath9k_hw_common(ah), DYNACK, -- "%pM to %u\n", dst, an->ackto); -+ "%pM to %d [%u]\n", dst, -+ an->ackto, ackto); - if (time_is_before_jiffies(da->lto)) { - ath_dynack_compute_ackto(ah); - da->lto = jiffies + COMPUTE_TO; -@@ -166,10 +171,12 @@ static void ath_dynack_compute_to(struct - * @ah: ath hw - * @skb: socket buffer - * @ts: tx status info -+ * @sta: station pointer - * - */ - void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb, -- struct ath_tx_status *ts) -+ struct ath_tx_status *ts, -+ struct ieee80211_sta *sta) - { - struct ieee80211_hdr *hdr; - struct ath_dynack *da = &ah->dynack; -@@ -191,9 +198,16 @@ void ath_dynack_sample_tx_ts(struct ath_ - ieee80211_is_assoc_resp(hdr->frame_control) || - ieee80211_is_auth(hdr->frame_control)) { - ath_dbg(common, DYNACK, "late ack\n"); -+ - ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2); - ath9k_hw_set_ack_timeout(ah, LATEACK_TO); - ath9k_hw_set_cts_timeout(ah, LATEACK_TO); -+ if (sta) { -+ struct ath_node *an; -+ -+ an = (struct ath_node *)sta->drv_priv; -+ an->ackto = -1; -+ } - da->lto = jiffies + LATEACK_DELAY; - } - ---- a/drivers/net/wireless/ath/ath9k/dynack.h -+++ b/drivers/net/wireless/ath/ath9k/dynack.h -@@ -86,7 +86,8 @@ void ath_dynack_node_deinit(struct ath_h - void ath_dynack_init(struct ath_hw *ah); - void ath_dynack_sample_ack_ts(struct ath_hw *ah, struct sk_buff *skb, u32 ts); - void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb, -- struct ath_tx_status *ts); -+ struct ath_tx_status *ts, -+ struct ieee80211_sta *sta); - #else - static inline void ath_dynack_init(struct ath_hw *ah) {} - static inline void ath_dynack_node_init(struct ath_hw *ah, -@@ -97,7 +98,8 @@ static inline void ath_dynack_sample_ack - struct sk_buff *skb, u32 ts) {} - static inline void ath_dynack_sample_tx_ts(struct ath_hw *ah, - struct sk_buff *skb, -- struct ath_tx_status *ts) {} -+ struct ath_tx_status *ts, -+ struct ieee80211_sta *sta) {} - #endif - - #endif /* DYNACK_H */ ---- a/drivers/net/wireless/ath/ath9k/xmit.c -+++ b/drivers/net/wireless/ath/ath9k/xmit.c -@@ -629,7 +629,7 @@ static void ath_tx_complete_aggr(struct - if (bf == bf->bf_lastbf) - ath_dynack_sample_tx_ts(sc->sc_ah, - bf->bf_mpdu, -- ts); -+ ts, sta); - } - - ath_tx_complete_buf(sc, bf, txq, &bf_head, sta, ts, -@@ -773,7 +773,8 @@ static void ath_tx_process_buffer(struct - memcpy(info->control.rates, bf->rates, - sizeof(info->control.rates)); - ath_tx_rc_status(sc, bf, ts, 1, txok ? 0 : 1, txok); -- ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts); -+ ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts, -+ sta); - } - ath_tx_complete_buf(sc, bf, txq, bf_head, sta, ts, txok); - } else diff --git a/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch index 16f252fdcd..47ecc9c655 100644 --- a/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch +++ b/package/kernel/mac80211/patches/ath/921-ath10k_init_devices_synchronously.patch @@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann --- a/drivers/net/wireless/ath/ath10k/core.c +++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -2719,6 +2719,16 @@ int ath10k_core_register(struct ath10k * +@@ -2720,6 +2720,16 @@ int ath10k_core_register(struct ath10k * ar->chip_id = chip_id; queue_work(ar->workqueue, &ar->register_work); diff --git a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch index bb29489c0b..50ed63b065 100644 --- a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch +++ b/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch @@ -172,7 +172,7 @@ v13: .patch_load_addr = QCA9888_HW_2_0_PATCH_LOAD_ADDR, .uart_pin = 7, .cc_wraparound_type = ATH10K_HW_CC_WRAP_SHIFTED_EACH, -@@ -2440,6 +2446,10 @@ int ath10k_core_start(struct ath10k *ar, +@@ -2441,6 +2447,10 @@ int ath10k_core_start(struct ath10k *ar, if (status) goto err_hif_stop; @@ -183,7 +183,7 @@ v13: return 0; err_hif_stop: -@@ -2694,9 +2704,18 @@ static void ath10k_core_register_work(st +@@ -2695,9 +2705,18 @@ static void ath10k_core_register_work(st goto err_spectral_destroy; } @@ -202,7 +202,7 @@ v13: err_spectral_destroy: ath10k_spectral_destroy(ar); err_debug_destroy: -@@ -2740,6 +2759,8 @@ void ath10k_core_unregister(struct ath10 +@@ -2741,6 +2760,8 @@ void ath10k_core_unregister(struct ath10 if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags)) return; diff --git a/package/kernel/mac80211/patches/brcm/307-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch b/package/kernel/mac80211/patches/brcm/307-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch deleted file mode 100644 index 154664c854..0000000000 --- a/package/kernel/mac80211/patches/brcm/307-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 3401d42c7ea2d064d15c66698ff8eb96553179ce Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= -Date: Fri, 26 Oct 2018 12:50:39 +0200 -Subject: [PATCH] brcmutil: really fix decoding channel info for 160 MHz - bandwidth -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Previous commit /adding/ support for 160 MHz chanspecs was incomplete. -It didn't set bandwidth info and didn't extract control channel info. As -the result it was also using uninitialized "sb" var. - -This change has been tested for two chanspecs found to be reported by -some devices/firmwares: -1) 60/160 (0xee32) - Before: chnum:50 control_ch_num:36 - After: chnum:50 control_ch_num:60 -2) 120/160 (0xed72) - Before: chnum:114 control_ch_num:100 - After: chnum:114 control_ch_num:120 - -Fixes: 330994e8e8ec ("brcmfmac: fix for proper support of 160MHz bandwidth") -Signed-off-by: Rafał Miłecki -Signed-off-by: Kalle Valo ---- - drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c -@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct - } - break; - case BRCMU_CHSPEC_D11AC_BW_160: -+ ch->bw = BRCMU_CHAN_BW_160; -+ ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK, -+ BRCMU_CHSPEC_D11AC_SB_SHIFT); - switch (ch->sb) { - case BRCMU_CHAN_SB_LLL: - ch->control_ch_num -= CH_70MHZ_APART; diff --git a/package/kernel/mac80211/patches/brcm/327-v5.0-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch b/package/kernel/mac80211/patches/brcm/327-v5.0-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch deleted file mode 100644 index 0ed148188b..0000000000 --- a/package/kernel/mac80211/patches/brcm/327-v5.0-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch +++ /dev/null @@ -1,110 +0,0 @@ -From b72c51a58e6d63ef673ac96b8ab5bc98799c5f7b Mon Sep 17 00:00:00 2001 -From: Lyude Paul -Date: Sat, 24 Nov 2018 17:57:05 -0500 -Subject: [PATCH] brcmfmac: Fix out of bounds memory access during fw load - -I ended up tracking down some rather nasty issues with f2fs (and other -filesystem modules) constantly crashing on my kernel down to a -combination of out of bounds memory accesses, one of which was coming -from brcmfmac during module load: - -[ 30.891382] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2 -[ 30.894437] ================================================================== -[ 30.901581] BUG: KASAN: global-out-of-bounds in brcmf_fw_alloc_request+0x42c/0x480 [brcmfmac] -[ 30.909935] Read of size 1 at addr ffff2000024865df by task kworker/6:2/387 -[ 30.916805] -[ 30.918261] CPU: 6 PID: 387 Comm: kworker/6:2 Tainted: G O 4.20.0-rc3Lyude-Test+ #19 -[ 30.927251] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018 -[ 30.935964] Workqueue: events brcmf_driver_register [brcmfmac] -[ 30.941641] Call trace: -[ 30.944058] dump_backtrace+0x0/0x3e8 -[ 30.947676] show_stack+0x14/0x20 -[ 30.950968] dump_stack+0x130/0x1c4 -[ 30.954406] print_address_description+0x60/0x25c -[ 30.959066] kasan_report+0x1b4/0x368 -[ 30.962683] __asan_report_load1_noabort+0x18/0x20 -[ 30.967547] brcmf_fw_alloc_request+0x42c/0x480 [brcmfmac] -[ 30.967639] brcmf_sdio_probe+0x163c/0x2050 [brcmfmac] -[ 30.978035] brcmf_ops_sdio_probe+0x598/0xa08 [brcmfmac] -[ 30.983254] sdio_bus_probe+0x190/0x398 -[ 30.983270] really_probe+0x2a0/0xa70 -[ 30.983296] driver_probe_device+0x1b4/0x2d8 -[ 30.994901] __driver_attach+0x200/0x280 -[ 30.994914] bus_for_each_dev+0x10c/0x1a8 -[ 30.994925] driver_attach+0x38/0x50 -[ 30.994935] bus_add_driver+0x330/0x608 -[ 30.994953] driver_register+0x140/0x388 -[ 31.013965] sdio_register_driver+0x74/0xa0 -[ 31.014076] brcmf_sdio_register+0x14/0x60 [brcmfmac] -[ 31.023177] brcmf_driver_register+0xc/0x18 [brcmfmac] -[ 31.023209] process_one_work+0x654/0x1080 -[ 31.032266] worker_thread+0x4f0/0x1308 -[ 31.032286] kthread+0x2a8/0x320 -[ 31.039254] ret_from_fork+0x10/0x1c -[ 31.039269] -[ 31.044226] The buggy address belongs to the variable: -[ 31.044351] brcmf_firmware_path+0x11f/0xfffffffffffd3b40 [brcmfmac] -[ 31.055601] -[ 31.057031] Memory state around the buggy address: -[ 31.061800] ffff200002486480: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 -[ 31.068983] ffff200002486500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -[ 31.068993] >ffff200002486580: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 -[ 31.068999] ^ -[ 31.069017] ffff200002486600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -[ 31.096521] ffff200002486680: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa -[ 31.096528] ================================================================== -[ 31.096533] Disabling lock debugging due to kernel taint - -It appears that when trying to determine the length of the string in the -alternate firmware path, we make the mistake of not handling the case -where the firmware path is empty correctly. Since strlen(mp_path) can -return 0, we'll end up accessing mp_path[-1] when the firmware_path -isn't provided through the module arguments. - -So, fix this by just setting the end char to '\0' by default, and only -changing it if we have a non-zero length. Additionally, use strnlen() -with BRCMF_FW_ALTPATH_LEN instead of strlen() just to be extra safe. - -Fixes: 2baa3aaee27f ("brcmfmac: introduce brcmf_fw_alloc_request() function") -Cc: Hante Meuleman -Cc: Pieter-Paul Giesberts -Cc: Franky Lin -Cc: Arend van Spriel -Cc: Kalle Valo -Cc: Arend Van Spriel -Cc: Himanshu Jha -Cc: Dan Haab -Cc: Jia-Shyr Chuang -Cc: Ian Molton -Cc: # v4.17+ -Signed-off-by: Lyude Paul -Signed-off-by: Kalle Valo ---- - .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c -@@ -708,8 +708,9 @@ brcmf_fw_alloc_request(u32 chip, u32 chi - struct brcmf_fw_request *fwreq; - char chipname[12]; - const char *mp_path; -+ size_t mp_path_len; - u32 i, j; -- char end; -+ char end = '\0'; - size_t reqsz; - - for (i = 0; i < table_size; i++) { -@@ -734,7 +735,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chi - mapping_table[i].fw_base, chipname); - - mp_path = brcmf_mp_global.firmware_path; -- end = mp_path[strlen(mp_path) - 1]; -+ mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN); -+ if (mp_path_len) -+ end = mp_path[mp_path_len - 1]; -+ - fwreq->n_items = n_fwnames; - - for (j = 0; j < n_fwnames; j++) { diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch index c73ee93a8d..9602792d4f 100644 --- a/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch +++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch @@ -17,7 +17,7 @@ Signed-off-by: Kalle Valo --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -6631,6 +6631,12 @@ static s32 brcmf_config_dongle(struct br +@@ -6638,6 +6638,12 @@ static s32 brcmf_config_dongle(struct br brcmf_configure_arp_nd_offload(ifp, true); diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch index f7e09ecaab..d44c8737ad 100644 --- a/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch +++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch @@ -77,6 +77,19 @@ Signed-off-by: Kalle Valo - entry->transit_count--; - if (entry->suppressed && entry->suppr_transit_count) - entry->suppr_transit_count--; +- +- brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name, flags, +- skcb->htod, seq); +- +- /* pick up the implicit credit from this packet */ +- fifo = brcmf_skb_htod_tag_get_field(skb, FIFO); +- if ((fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT) || +- (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) || +- (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)) { +- brcmf_fws_return_credits(fws, fifo, 1); +- brcmf_fws_schedule_deq(fws); +- } +- brcmf_fws_macdesc_return_req_credit(skb); + skcb = brcmf_skbcb(skb); + entry = skcb->mac; + if (WARN_ON(!entry)) { @@ -87,20 +100,13 @@ Signed-off-by: Kalle Valo + if (entry->suppressed && entry->suppr_transit_count) + entry->suppr_transit_count--; -- brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name, flags, -- skcb->htod, seq); +- ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp); +- if (ret) { +- brcmu_pkt_buf_free_skb(skb); +- return -EINVAL; + brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name, + flags, skcb->htod, seq); - -- /* pick up the implicit credit from this packet */ -- fifo = brcmf_skb_htod_tag_get_field(skb, FIFO); -- if ((fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT) || -- (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) || -- (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)) { -- brcmf_fws_return_credits(fws, fifo, 1); -- brcmf_fws_schedule_deq(fws); -- } -- brcmf_fws_macdesc_return_req_credit(skb); ++ + /* pick up the implicit credit from this packet */ + fifo = brcmf_skb_htod_tag_get_field(skb, FIFO); + if (fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT || @@ -110,11 +116,7 @@ Signed-off-by: Kalle Valo + brcmf_fws_schedule_deq(fws); + } + brcmf_fws_macdesc_return_req_credit(skb); - -- ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp); -- if (ret) { -- brcmu_pkt_buf_free_skb(skb); -- return -EINVAL; ++ + ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp); + if (ret) { + brcmu_pkt_buf_free_skb(skb); diff --git a/package/kernel/mac80211/patches/brcm/331-v5.0-0001-brcmfmac-fix-roamoff-1-modparam.patch b/package/kernel/mac80211/patches/brcm/331-v5.0-0001-brcmfmac-fix-roamoff-1-modparam.patch deleted file mode 100644 index 4ddc903418..0000000000 --- a/package/kernel/mac80211/patches/brcm/331-v5.0-0001-brcmfmac-fix-roamoff-1-modparam.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 8c892df41500469729e0d662816300196e4f463d Mon Sep 17 00:00:00 2001 -From: Stijn Tintel -Date: Tue, 4 Dec 2018 20:29:05 +0200 -Subject: [PATCH] brcmfmac: fix roamoff=1 modparam - -When the update_connect_param callback is set, nl80211 expects the flag -WIPHY_FLAG_SUPPORTS_FW_ROAM to be set as well. However, this flag is -only set when modparam roamoff=0, while the callback is set -unconditionally. Since commit 7f9a3e150ec7 this causes a warning in -wiphy_register, which breaks brcmfmac. - -Disable the update_connect_param callback when roamoff=0 to fix this. - -Fixes: 7f9a3e150ec7 ("nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS") -Cc: Stable # 4.19+ -Signed-off-by: Jonas Gorski -Signed-off-by: Stijn Tintel -Signed-off-by: Kalle Valo ---- - .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 11 +++++++++-- - .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.h | 2 +- - .../net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +- - 3 files changed, 11 insertions(+), 4 deletions(-) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -5188,10 +5188,17 @@ static struct cfg80211_ops brcmf_cfg8021 - .del_pmk = brcmf_cfg80211_del_pmk, - }; - --struct cfg80211_ops *brcmf_cfg80211_get_ops(void) -+struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings) - { -- return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops), -+ struct cfg80211_ops *ops; -+ -+ ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops), - GFP_KERNEL); -+ -+ if (ops && settings->roamoff) -+ ops->update_connect_params = NULL; -+ -+ return ops; - } - - struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg, ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h -@@ -404,7 +404,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802 - void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg); - s32 brcmf_cfg80211_up(struct net_device *ndev); - s32 brcmf_cfg80211_down(struct net_device *ndev); --struct cfg80211_ops *brcmf_cfg80211_get_ops(void); -+struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings); - enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp); - - struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg, ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -1151,7 +1151,7 @@ int brcmf_attach(struct device *dev, str - - brcmf_dbg(TRACE, "Enter\n"); - -- ops = brcmf_cfg80211_get_ops(); -+ ops = brcmf_cfg80211_get_ops(settings); - if (!ops) - return -ENOMEM; - diff --git a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch index 1d4bf12652..06636060f7 100644 --- a/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch +++ b/package/kernel/mac80211/patches/build/060-no_local_ssb_bcma.patch @@ -1,6 +1,6 @@ --- a/local-symbols +++ b/local-symbols -@@ -395,43 +395,6 @@ USB_IPHETH= +@@ -396,43 +396,6 @@ USB_IPHETH= USB_SIERRA_NET= USB_VL600= USB_NET_CH9200= @@ -192,7 +192,7 @@ select BRCMUTIL --- a/Kconfig.local +++ b/Kconfig.local -@@ -1189,117 +1189,6 @@ config BACKPORTED_USB_VL600 +@@ -1192,117 +1192,6 @@ config BACKPORTED_USB_VL600 config BACKPORTED_USB_NET_CH9200 tristate default USB_NET_CH9200 diff --git a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch index 18a3fb82ea..d238072b9a 100644 --- a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch +++ b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch @@ -1,6 +1,6 @@ --- a/local-symbols +++ b/local-symbols -@@ -304,6 +304,7 @@ RT2X00_LIB_FIRMWARE= +@@ -305,6 +305,7 @@ RT2X00_LIB_FIRMWARE= RT2X00_LIB_CRYPTO= RT2X00_LIB_LEDS= RT2X00_LIB_DEBUGFS= diff --git a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch index 8d202eed91..639cce0886 100644 --- a/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch +++ b/package/kernel/mac80211/patches/rt2x00/982-rt2x00-add-rf-self-txdc-calibration.patch @@ -59,7 +59,7 @@ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev, bool set_bw, bool is_ht40) { -@@ -8961,6 +9013,7 @@ static void rt2800_init_rfcsr_6352(struc +@@ -8943,6 +8995,7 @@ static void rt2800_init_rfcsr_6352(struc rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00); rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C); diff --git a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch index 2f7a4eb948..5bba1f2e0e 100644 --- a/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch +++ b/package/kernel/mac80211/patches/rt2x00/983-rt2x00-add-r-calibration.patch @@ -161,7 +161,7 @@ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev, bool set_bw, bool is_ht40) { -@@ -9013,6 +9167,7 @@ static void rt2800_init_rfcsr_6352(struc +@@ -8995,6 +9149,7 @@ static void rt2800_init_rfcsr_6352(struc rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00); rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C); diff --git a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch index 585d61b303..6a212c3054 100644 --- a/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch +++ b/package/kernel/mac80211/patches/rt2x00/984-rt2x00-add-rxdcoc-calibration.patch @@ -72,7 +72,7 @@ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev, bool set_bw, bool is_ht40) { -@@ -9169,6 +9234,7 @@ static void rt2800_init_rfcsr_6352(struc +@@ -9151,6 +9216,7 @@ static void rt2800_init_rfcsr_6352(struc rt2800_r_calibration(rt2x00dev); rt2800_rf_self_txdc_cal(rt2x00dev); diff --git a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch index c65b24ad96..b93cdab7bb 100644 --- a/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch +++ b/package/kernel/mac80211/patches/rt2x00/985-rt2x00-add-rxiq-calibration.patch @@ -387,7 +387,7 @@ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev, bool set_bw, bool is_ht40) { -@@ -9237,6 +9617,7 @@ static void rt2800_init_rfcsr_6352(struc +@@ -9219,6 +9599,7 @@ static void rt2800_init_rfcsr_6352(struc rt2800_rxdcoc_calibration(rt2x00dev); rt2800_bw_filter_calibration(rt2x00dev, true); rt2800_bw_filter_calibration(rt2x00dev, false); diff --git a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch index f685365fb8..cfffd53df8 100644 --- a/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch +++ b/package/kernel/mac80211/patches/rt2x00/986-rt2x00-add-TX-LOFT-calibration.patch @@ -958,7 +958,7 @@ static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev, bool set_bw, bool is_ht40) { -@@ -9617,6 +10568,7 @@ static void rt2800_init_rfcsr_6352(struc +@@ -9599,6 +10550,7 @@ static void rt2800_init_rfcsr_6352(struc rt2800_rxdcoc_calibration(rt2x00dev); rt2800_bw_filter_calibration(rt2x00dev, true); rt2800_bw_filter_calibration(rt2x00dev, false); diff --git a/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch index f7116eb9f7..42a6382209 100644 --- a/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch +++ b/package/kernel/mac80211/patches/subsys/140-tweak-TSQ-setting.patch @@ -1,6 +1,6 @@ --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -3791,6 +3791,12 @@ out: +@@ -3797,6 +3797,12 @@ out: netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev) { diff --git a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch index db3c693fd4..1581b3400b 100644 --- a/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch +++ b/package/kernel/mac80211/patches/subsys/150-disable_addr_notifier.patch @@ -52,7 +52,7 @@ fail_ifa: #endif rtnl_lock(); -@@ -1220,10 +1220,10 @@ void ieee80211_unregister_hw(struct ieee +@@ -1219,10 +1219,10 @@ void ieee80211_unregister_hw(struct ieee tasklet_kill(&local->tx_pending_tasklet); tasklet_kill(&local->tasklet); @@ -64,4 +64,4 @@ +#if IS_ENABLED(__disabled__CONFIG_IPV6) unregister_inet6addr_notifier(&local->ifa6_notifier); #endif - ieee80211_txq_teardown_flows(local); + diff --git a/package/kernel/mac80211/patches/subsys/351-mac80211-free-skb-fraglist-before-freeing-the-skb.patch b/package/kernel/mac80211/patches/subsys/351-mac80211-free-skb-fraglist-before-freeing-the-skb.patch deleted file mode 100644 index dc12290f4f..0000000000 --- a/package/kernel/mac80211/patches/subsys/351-mac80211-free-skb-fraglist-before-freeing-the-skb.patch +++ /dev/null @@ -1,31 +0,0 @@ -From: Sara Sharon -Date: Thu, 11 Oct 2018 14:21:21 +0200 -Subject: [PATCH] mac80211: free skb fraglist before freeing the skb - -mac80211 uses the frag list to build AMSDU. When freeing -the skb, it may not be really freed, since someone is still -holding a reference to it. -In that case, when TCP skb is being retransmitted, the -pointer to the frag list is being reused, while the data -in there is no longer valid. -Since we will never get frag list from the network stack, -as mac80211 doesn't advertise the capability, we can safely -free and nullify it before releasing the SKB. - -Signed-off-by: Sara Sharon ---- - ---- a/net/mac80211/status.c -+++ b/net/mac80211/status.c -@@ -558,6 +558,11 @@ static void ieee80211_report_used_skb(st - } - - ieee80211_led_tx(local); -+ -+ if (skb_has_frag_list(skb)) { -+ kfree_skb_list(skb_shinfo(skb)->frag_list); -+ skb_shinfo(skb)->frag_list = NULL; -+ } - } - - /* diff --git a/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch index a0221c0d6c..a6bd3eab6e 100644 --- a/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch +++ b/package/kernel/mac80211/patches/subsys/357-mac80211-add-hdrlen-to-ieee80211_tx_data.patch @@ -48,7 +48,7 @@ Signed-off-by: Janusz Dziedzic if (likely(sta)) { if (!IS_ERR(sta)) tx->sta = sta; -@@ -3501,6 +3501,7 @@ begin: +@@ -3507,6 +3507,7 @@ begin: tx.local = local; tx.skb = skb; tx.sdata = vif_to_sdata(info->control.vif); @@ -56,7 +56,7 @@ Signed-off-by: Janusz Dziedzic if (txq->sta) tx.sta = container_of(txq->sta, struct sta_info, sta); -@@ -3837,6 +3838,7 @@ ieee80211_build_data_template(struct iee +@@ -3843,6 +3844,7 @@ ieee80211_build_data_template(struct iee hdr = (void *)skb->data; tx.sta = sta_info_get(sdata, hdr->addr1); tx.skb = skb; diff --git a/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch index 42274cbab1..bc87d0a45b 100644 --- a/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch +++ b/package/kernel/mac80211/patches/subsys/358-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch @@ -147,7 +147,7 @@ Signed-off-by: Janusz Dziedzic if (likely(sta)) { if (!IS_ERR(sta)) -@@ -2209,7 +2208,7 @@ netdev_tx_t ieee80211_monitor_start_xmit +@@ -2215,7 +2214,7 @@ netdev_tx_t ieee80211_monitor_start_xmit goto fail; hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr); @@ -156,7 +156,7 @@ Signed-off-by: Janusz Dziedzic if (skb->len < len_rthdr + hdrlen) goto fail; -@@ -2427,7 +2426,7 @@ static struct sk_buff *ieee80211_build_h +@@ -2433,7 +2432,7 @@ static struct sk_buff *ieee80211_build_h struct ieee80211_chanctx_conf *chanctx_conf; struct ieee80211_sub_if_data *ap_sdata; enum nl80211_band band; @@ -165,7 +165,7 @@ Signed-off-by: Janusz Dziedzic if (IS_ERR(sta)) sta = NULL; -@@ -2647,6 +2646,9 @@ static struct sk_buff *ieee80211_build_h +@@ -2653,6 +2652,9 @@ static struct sk_buff *ieee80211_build_h hdrlen += 2; } @@ -175,7 +175,7 @@ Signed-off-by: Janusz Dziedzic /* * Drop unicast frames to unauthorised stations unless they are * EAPOL frames from the local station. -@@ -2727,6 +2729,7 @@ static struct sk_buff *ieee80211_build_h +@@ -2733,6 +2735,7 @@ static struct sk_buff *ieee80211_build_h skb_pull(skb, skip_header_bytes); head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb); @@ -183,7 +183,7 @@ Signed-off-by: Janusz Dziedzic /* * So we need to modify the skb header and hence need a copy of -@@ -2759,6 +2762,9 @@ static struct sk_buff *ieee80211_build_h +@@ -2765,6 +2768,9 @@ static struct sk_buff *ieee80211_build_h memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen); #endif @@ -193,7 +193,7 @@ Signed-off-by: Janusz Dziedzic if (ieee80211_is_data_qos(fc)) { __le16 *qos_control; -@@ -2934,6 +2940,9 @@ void ieee80211_check_fast_xmit(struct st +@@ -2940,6 +2946,9 @@ void ieee80211_check_fast_xmit(struct st fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA); } @@ -203,7 +203,7 @@ Signed-off-by: Janusz Dziedzic /* We store the key here so there's no point in using rcu_dereference() * but that's fine because the code that changes the pointers will call * this function after doing so. For a single CPU that would be enough, -@@ -3528,7 +3537,7 @@ begin: +@@ -3534,7 +3543,7 @@ begin: if (tx.key && (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) diff --git a/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch b/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch index 055472206e..6f1239ccab 100644 --- a/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch +++ b/package/kernel/mac80211/patches/subsys/371-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch @@ -67,7 +67,7 @@ Signed-off-by: Felix Fietkau ccflags-y += -DDEBUG --- a/net/mac80211/main.c +++ b/net/mac80211/main.c -@@ -1306,18 +1306,12 @@ static int __init ieee80211_init(void) +@@ -1304,18 +1304,12 @@ static int __init ieee80211_init(void) if (ret) return ret; @@ -86,7 +86,7 @@ Signed-off-by: Felix Fietkau rc80211_minstrel_exit(); return ret; -@@ -1325,7 +1319,6 @@ static int __init ieee80211_init(void) +@@ -1323,7 +1317,6 @@ static int __init ieee80211_init(void) static void __exit ieee80211_exit(void) { diff --git a/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch b/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch index fe0b98c3ac..4e83ff1ea0 100644 --- a/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch +++ b/package/kernel/mac80211/patches/subsys/378-mac80211-fix-memory-accounting-with-A-MSDU-aggregati.patch @@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -3188,6 +3188,7 @@ static bool ieee80211_amsdu_aggregate(st +@@ -3194,6 +3194,7 @@ static bool ieee80211_amsdu_aggregate(st u8 max_subframes = sta->sta.max_amsdu_subframes; int max_frags = local->hw.max_tx_fragments; int max_amsdu_len = sta->sta.max_amsdu_len; @@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau __be16 len; void *data; bool ret = false; -@@ -3219,12 +3220,13 @@ static bool ieee80211_amsdu_aggregate(st +@@ -3225,12 +3226,13 @@ static bool ieee80211_amsdu_aggregate(st flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func); head = skb_peek_tail(&flow->queue); if (!head) @@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau nfrags = 1 + skb_shinfo(skb)->nr_frags; nfrags += 1 + skb_shinfo(head)->nr_frags; -@@ -3282,6 +3284,9 @@ out_recalc: +@@ -3288,6 +3290,9 @@ out_recalc: fq_recalc_backlog(fq, tin, flow); } out: diff --git a/package/kernel/mac80211/patches/subsys/379-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch b/package/kernel/mac80211/patches/subsys/379-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch deleted file mode 100644 index ee2059f9c8..0000000000 --- a/package/kernel/mac80211/patches/subsys/379-mac80211-ignore-tx-status-for-PS-stations-in-ieee802.patch +++ /dev/null @@ -1,26 +0,0 @@ -From: Felix Fietkau -Date: Tue, 13 Nov 2018 20:29:03 +0100 -Subject: [PATCH] mac80211: ignore tx status for PS stations in - ieee80211_tx_status_ext - -Make it behave like regular ieee80211_tx_status calls, except for the lack of -filtered frame processing. -This fixes spurious low-ack triggered disconnections with powersave clients -connected to an AP. - -Fixes: f027c2aca0cf4 ("mac80211: add ieee80211_tx_status_noskb") -Cc: stable@vger.kernel.org -Signed-off-by: Felix Fietkau ---- - ---- a/net/mac80211/status.c -+++ b/net/mac80211/status.c -@@ -984,6 +984,8 @@ void ieee80211_tx_status_ext(struct ieee - /* Track when last TDLS packet was ACKed */ - if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH)) - sta->status_stats.last_tdls_pkt_time = jiffies; -+ } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) { -+ return; - } else { - ieee80211_lost_packet(sta, info); - } diff --git a/package/kernel/mac80211/patches/subsys/380-mac80211-fix-reordering-of-buffered-broadcast-packet.patch b/package/kernel/mac80211/patches/subsys/380-mac80211-fix-reordering-of-buffered-broadcast-packet.patch deleted file mode 100644 index 4257365a79..0000000000 --- a/package/kernel/mac80211/patches/subsys/380-mac80211-fix-reordering-of-buffered-broadcast-packet.patch +++ /dev/null @@ -1,28 +0,0 @@ -From: Felix Fietkau -Date: Wed, 28 Nov 2018 22:36:06 +0100 -Subject: [PATCH] mac80211: fix reordering of buffered broadcast packets - -If the buffered broadcast queue contains packets, letting new packets bypass -that queue can lead to heavy reordering, since the driver is probably throttling -transmission of buffered multicast packets after beacons. - -Keep buffering packets until the buffer has been cleared (and no client -is in powersave mode). - -Cc: stable@vger.kernel.org -Signed-off-by: Felix Fietkau ---- - ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -439,8 +439,8 @@ ieee80211_tx_h_multicast_ps_buf(struct i - if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL)) - info->hw_queue = tx->sdata->vif.cab_queue; - -- /* no stations in PS mode */ -- if (!atomic_read(&ps->num_sta_ps)) -+ /* no stations in PS mode and no buffered packets */ -+ if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf)) - return TX_CONTINUE; - - info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM; diff --git a/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch b/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch deleted file mode 100644 index 606897d1fe..0000000000 --- a/package/kernel/mac80211/patches/subsys/381-mac80211-fix-a-kernel-panic-when-TXing-after-TXQ-tea.patch +++ /dev/null @@ -1,60 +0,0 @@ -From a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 Mon Sep 17 00:00:00 2001 -From: Sara Sharon -Date: Sat, 15 Dec 2018 11:03:10 +0200 -Subject: [PATCH 1/3] mac80211: fix a kernel panic when TXing after TXQ - teardown - -Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(), -to avoid a use-after-free of the netdev data. However, interfaces -aren't fully removed at the point, and cfg80211_shutdown_all_interfaces -can for example, TX a deauth frame. Move the TXQ teardown to the -point between cfg80211_shutdown_all_interfaces and the free of -netdev queues, so we can be sure they are torn down before netdev -is freed, but after there is no ongoing TX. - -Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces") -Signed-off-by: Sara Sharon -Signed-off-by: Luca Coelho -Signed-off-by: Johannes Berg ---- - net/mac80211/iface.c | 3 +++ - net/mac80211/main.c | 2 -- - 2 files changed, 3 insertions(+), 2 deletions(-) - ---- a/net/mac80211/iface.c -+++ b/net/mac80211/iface.c -@@ -7,6 +7,7 @@ - * Copyright 2008, Johannes Berg - * Copyright 2013-2014 Intel Mobile Communications GmbH - * Copyright (c) 2016 Intel Deutschland GmbH -+ * Copyright (C) 2018 Intel Corporation - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -2035,6 +2036,8 @@ void ieee80211_remove_interfaces(struct - WARN(local->open_count, "%s: open count remains %d\n", - wiphy_name(local->hw.wiphy), local->open_count); - -+ ieee80211_txq_teardown_flows(local); -+ - mutex_lock(&local->iflist_mtx); - list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) { - list_del(&sdata->list); ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -1200,7 +1200,6 @@ int ieee80211_register_hw(struct ieee802 - rtnl_unlock(); - ieee80211_led_exit(local); - ieee80211_wep_free(local); -- ieee80211_txq_teardown_flows(local); - fail_flows: - destroy_workqueue(local->workqueue); - fail_workqueue: -@@ -1226,7 +1225,6 @@ void ieee80211_unregister_hw(struct ieee - #if IS_ENABLED(__disabled__CONFIG_IPV6) - unregister_inet6addr_notifier(&local->ifa6_notifier); - #endif -- ieee80211_txq_teardown_flows(local); - - rtnl_lock(); - diff --git a/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch b/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch deleted file mode 100644 index d31d45bbdf..0000000000 --- a/package/kernel/mac80211/patches/subsys/382-nl80211-fix-memory-leak-if-validate_pae_over_nl80211.patch +++ /dev/null @@ -1,29 +0,0 @@ -From d350a0f431189517b1af0dbbb605c273231a8966 Mon Sep 17 00:00:00 2001 -From: Johannes Berg -Date: Sat, 15 Dec 2018 11:03:22 +0200 -Subject: [PATCH 2/3] nl80211: fix memory leak if validate_pae_over_nl80211() - fails - -If validate_pae_over_nl80211() were to fail in nl80211_crypto_settings(), -we might leak the 'connkeys' allocation. Fix this. - -Fixes: 64bf3d4bc2b0 ("nl80211: Add CONTROL_PORT_OVER_NL80211 attribute") -Signed-off-by: Johannes Berg ---- - net/wireless/nl80211.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -9002,8 +9002,10 @@ static int nl80211_join_ibss(struct sk_b - if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { - int r = validate_pae_over_nl80211(rdev, info); - -- if (r < 0) -+ if (r < 0) { -+ kzfree(connkeys); - return r; -+ } - - ibss.control_port_over_nl80211 = true; - } diff --git a/package/kernel/mac80211/patches/subsys/383-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch b/package/kernel/mac80211/patches/subsys/383-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch index 2c706b101f..2b9ff93db6 100644 --- a/package/kernel/mac80211/patches/subsys/383-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch +++ b/package/kernel/mac80211/patches/subsys/383-mac80211-minstrel_ht-add-flag-to-indicate-missing-in.patch @@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau --- a/include/net/mac80211.h +++ b/include/net/mac80211.h -@@ -2132,6 +2132,9 @@ struct ieee80211_txq { +@@ -2130,6 +2130,9 @@ struct ieee80211_txq { * @IEEE80211_HW_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte. * Padding will be added after ieee80211_hdr, before IV/LLC. * @@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays */ enum ieee80211_hw_flags { -@@ -2178,6 +2181,7 @@ enum ieee80211_hw_flags { +@@ -2176,6 +2179,7 @@ enum ieee80211_hw_flags { IEEE80211_HW_DEAUTH_NEED_MGD_TX_PREP, IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP, IEEE80211_HW_NEEDS_ALIGNED4_SKBS, diff --git a/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch b/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch deleted file mode 100644 index 1c1951eadd..0000000000 --- a/package/kernel/mac80211/patches/subsys/384-mac80211-ensure-that-management-tx-skbs-have-encrypt.patch +++ /dev/null @@ -1,48 +0,0 @@ -From: Felix Fietkau -Date: Mon, 28 Jan 2019 13:16:45 +0100 -Subject: [PATCH] mac80211: ensure that management tx skbs have encryption - tailroom - -Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management -frames need to be software encrypted. Since normal data packets are still -encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented -after key upload. This can lead to passing skbs to ccmp_encrypt_skb, which -don't have the needed tailroom for software encryption. - -Change the code to add tailroom for encrypted management packets, even if -crypto_tx_tailroom_needed_cnt is 0. - -Cc: stable@vger.kernel.org -Signed-off-by: Felix Fietkau ---- - ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -1912,9 +1912,16 @@ static int ieee80211_skb_resize(struct i - int head_need, bool may_encrypt) - { - struct ieee80211_local *local = sdata->local; -+ struct ieee80211_hdr *hdr; -+ bool enc_tailroom; - int tail_need = 0; - -- if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) { -+ hdr = (struct ieee80211_hdr *) skb->data; -+ enc_tailroom = may_encrypt && -+ (sdata->crypto_tx_tailroom_needed_cnt || -+ ieee80211_is_mgmt(hdr->frame_control)); -+ -+ if (enc_tailroom) { - tail_need = IEEE80211_ENCRYPT_TAILROOM; - tail_need -= skb_tailroom(skb); - tail_need = max_t(int, tail_need, 0); -@@ -1922,8 +1929,7 @@ static int ieee80211_skb_resize(struct i - - if (skb_cloned(skb) && - (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) || -- !skb_clone_writable(skb, ETH_HLEN) || -- (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt))) -+ !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom)) - I802_DEBUG_INC(local->tx_expand_skb_head_cloned); - else if (head_need || tail_need) - I802_DEBUG_INC(local->tx_expand_skb_head);