package/kernel/mac80211/patches/mwl/941-mwl8k-Fix-rate_idx-underflow.patch

   1 From b897577af85bb5e5638efa780bc3716fae5212d3 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
   3 Date: Mon, 8 Apr 2019 09:45:56 +0200
   4 Subject: [PATCH] mwl8k: Fix rate_idx underflow
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 It was reported on OpenWrt bug tracking system[1], that several users
  10 are affected by the endless reboot of their routers if they configure
  11 5GHz interface with channel 44 or 48.
  12
  13 The reboot loop is caused by the following excessive number of WARN_ON
  14 messages:
  15
  16  WARNING: CPU: 0 PID: 0 at backports-4.19.23-1/net/mac80211/rx.c:4516
  17                              ieee80211_rx_napi+0x1fc/0xa54 [mac80211]
  18
  19 as the messages are being correctly emitted by the following guard:
  20
  21  case RX_ENC_LEGACY:
  22       if (WARN_ON(status->rate_idx >= sband->n_bitrates))
  23
  24 as the rate_idx is in this case erroneously set to 251 (0xfb). This fix
  25 simply converts previously used magic number to proper constant and
  26 guards against substraction which is leading to the currently observed
  27 underflow.
  28
  29 1. https://bugs.openwrt.org/index.php?do=details&task_id=2218
  30
  31 Fixes: 854783444bab ("mwl8k: properly set receive status rate index on 5 GHz receive")
  32 Cc: <stable@vger.kernel.org>
  33 Tested-by: Eubert Bao <bunnier@gmail.com>
  34 Reported-by: Eubert Bao <bunnier@gmail.com>
  35 Signed-off-by: Petr Štetiar <ynezz@true.cz>
  36 ---
  37  drivers/net/wireless/marvell/mwl8k.c | 13 +++++++++----
  38  1 file changed, 9 insertions(+), 4 deletions(-)
  39
  40 diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
  41 index 8e4e9b6..ffc565a 100644
  42 --- a/drivers/net/wireless/marvell/mwl8k.c
  43 +++ b/drivers/net/wireless/marvell/mwl8k.c
  44 @@ -441,6 +441,9 @@ struct mwl8k_sta {
  45  #define MWL8K_CMD_UPDATE_STADB         0x1123
  46  #define MWL8K_CMD_BASTREAM             0x1125
  47
  48 +#define MWL8K_LEGACY_5G_RATE_OFFSET \
  49 +       (ARRAY_SIZE(mwl8k_rates_24) - ARRAY_SIZE(mwl8k_rates_50))
  50 +
  51  static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
  52  {
  53         u16 command = le16_to_cpu(cmd);
  54 @@ -1016,8 +1019,9 @@ static void mwl8k_rxd_ap_refill(void *_rxd, dma_addr_t addr, int len)
  55
  56         if (rxd->channel > 14) {
  57                 status->band = NL80211_BAND_5GHZ;
  58 -               if (!(status->encoding == RX_ENC_HT))
  59 -                       status->rate_idx -= 5;
  60 +               if (!(status->encoding == RX_ENC_HT) &&
  61 +                   status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
  62 +                       status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
  63         } else {
  64                 status->band = NL80211_BAND_2GHZ;
  65         }
  66 @@ -1124,8 +1128,9 @@ static void mwl8k_rxd_sta_refill(void *_rxd, dma_addr_t addr, int len)
  67
  68         if (rxd->channel > 14) {
  69                 status->band = NL80211_BAND_5GHZ;
  70 -               if (!(status->encoding == RX_ENC_HT))
  71 -                       status->rate_idx -= 5;
  72 +               if (!(status->encoding == RX_ENC_HT) &&
  73 +                   status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
  74 +                       status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
  75         } else {
  76                 status->band = NL80211_BAND_2GHZ;
  77         }
  78 --
  79 1.9.1
  80