summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/mediatek/mt76
AgeCommit message (Collapse)Author
2023-02-03wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exitLorenzo Bianconi
Always purge mcu skb queues in mt7996_mcu_exit routine even if mt7996_firmware_state fails. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exitLorenzo Bianconi
Always purge mcu skb queues in mt7915_mcu_exit routine even if mt7915_firmware_state fails. Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: introduce mt76_queue_is_wed_rx utility routineLorenzo Bianconi
This patch does not change any logic, just improve code readability. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7921: fix invalid remain_on_channel durationDeren Wu
round_jiffies_up() may change the duration reported from chip. We should take the real timeout for current channel privilege. Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Signed-off-by: Deren Wu <deren.wu@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7915: remove BW160 and BW80+80 supportMeiChia Chiu
Remove BW160 and BW80+80 capability in mt7915. Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Reviewed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Money Wang<Money.Wang@mediatek.com> Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: connac: fix POWER_CTRL command name typoShayne Chen
Fix typo MCU_UNI_CMD_POWER_CREL to MCU_UNI_CMD_POWER_CTRL. Fixes: 779d34de055e ("wifi: mt76: connac: add more unified command IDs") Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7996: do not hardcode vht beamform capShayne Chen
Use the sts variable when setting vht beamform sts cap. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7996: update register for CFEND_RATEShayne Chen
In newer chipsets, CFEND_RATE setting has been moved to different hw module. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7996: fix chainmask calculation in mt7996_set_antenna()Shayne Chen
Fix per-band chainmask when restoring from the dev chainmask. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7921: add ack signal supportDeren Wu
This reports signal strength of ACK packets from the peer as measured at each interface. Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Deren Wu <deren.wu@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7921: fix channel switch fail in monitor modeDeren Wu
When the chanctx enabled, IEEE80211_CONF_CHANGE_CHANNEL in .config() would not be called anymore. mt76 cannot control RF channel for monitor. Add monitor type set-channel flow in .change_chanctx(). Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support") Reviewed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Deren Wu <deren.wu@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7915: add chip id condition in mt7915_check_eeprom()Shayne Chen
When flash mode is enabled, and the eeprom data in the flash is not for the current chipset, it'll still be checked valid, and the default eeprom bin won't be loaded. (e.g., mt7915 NIC inserted with mt7916 eeprom data in the flash.) Fix this kind of case by adding chip id into consideration in mt7915_check_eeprom(). Reported-by: Cheng-Ji Li <cheng-ji.li@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7915: add error message in mt7915_thermal_set_cur_throttle_state()Howard Hsu
Add dev_err so that it is easier to see invalid setting while looking at dmesg. Co-developed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7915: rework mt7915_thermal_temp_store()Howard Hsu
Call mt7915_mcu_set_thermal_protect() through mt7915_thermal_temp_store() to update firmware trigger/restore temp directly. Fixes: 02ee68b95d81 ("mt76: mt7915: add control knobs for thermal throttling") Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7915: rework mt7915_mcu_set_thermal_throttlingHoward Hsu
This patch includes 2 changes: 1. Firmware expects to disable thermal protect first before reconfiguring. 2. Separate setting thermal_protect and setting thermal_tx_duty into different functions. These two firmware commands do not need to send together. Fixes: 34b877d972be ("mt76: mt7915: add thermal cooling device support") Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after ↵Howard Hsu
init_work Enable thermal management by default shall not be executed during mcu init. This causes thermal configuration being reset to the firmware default settings. Fixes: 0063b86c9120 ("mt76: mt7915e: Enable thermal management by default") Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-02-03wifi: mt76: mt7921: fix deadlock in mt7921_abort_rocFelix Fietkau
When mt7921_abort_roc is called with dev->mutex held, it can deadlock while calling cancel_work_sync(&phy->roc_work), because the work function could be waiting to acquire the mutex. Fix this by flushing the work before taking the mutex Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support") Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-01-17Merge wireless into wireless-nextKalle Valo
Due to the two cherry picked commits from wireless to wireless-next we have several conflicts in mt76. To avoid any bugs with conflicts merge wireless into wireless-next. 96f134dc1964 wifi: mt76: handle possible mt76_rx_token_consume failures fe13dad8992b wifi: mt76: dma: do not increment queue head if mt76_dma_add_buf fails
2023-01-16wifi: mt76: dma: fix a regression in adding rx buffersFelix Fietkau
When adding WED support, mt76_dma_add_buf was accidentally changed to set the skip_buf0 flag for tx buffers on the wrong queue descriptor entry. Additionally, there is a rxwi leak when rx buffer allocation fails. Fix this and make the code more readable by adding a separate function for adding rx buffers. Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Link: https://lore.kernel.org/r/CABXGCsMEnQd=gYKTd1knRsWuxCb=Etv5nAre%2BXJS_s5FgVteYA@mail.gmail.com/ Reported-by: Mike Lothian <mike@fireburn.co.uk> Link: https://bugzilla.kernel.org/show_bug.cgi?id=216829 Reported-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://lore.kernel.org/lkml/20230112171706.294550-1-angelogioacchino.delregno@collabora.com/ Fixes: cd372b8c99c5 ("wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf") Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230113105848.34642-3-nbd@nbd.name
2023-01-16wifi: mt76: handle possible mt76_rx_token_consume failuresLorenzo Bianconi
Take into account possible error conditions of mt76_rx_token_consume routine in mt7915_mmio_wed_init_rx_buf() and mt76_dma_add_buf() Fixes: cd372b8c99c5 ("wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf") Fixes: 4f831d18d12d ("wifi: mt76: mt7915: enable WED RX support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit 96f134dc19645be4994e89a2f68fa89309becbee) Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230113105848.34642-2-nbd@nbd.name
2023-01-16wifi: mt76: dma: do not increment queue head if mt76_dma_add_buf failsLorenzo Bianconi
Do not increment queue head if mt76_dma_add_buf fails for Wireless Ethernet Dispatcher rx queues. Fixes: cd372b8c99c5 ("wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> (cherry picked from commit fe13dad8992be0b26c1be390bcd111acf9892c17) Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230113105848.34642-1-nbd@nbd.name
2022-12-21Merge tag 'mt76-for-kvalo-2022-12-09' of https://github.com/nbd168/wirelessKalle Valo
mt76 patches for 6.2 - fixes - per-PHY LED support
2022-12-20wifi: mt76: mt7996: select CONFIG_RELAYArnd Bergmann
Without CONFIG_RELAY, the driver fails to link: ERROR: modpost: "relay_flush" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! ERROR: modpost: "relay_switch_subbuf" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! ERROR: modpost: "relay_open" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! ERROR: modpost: "relay_reset" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! ERROR: modpost: "relay_file_operations" [drivers/net/wireless/mediatek/mt76/mt7996/mt7996e.ko] undefined! The same change was done in mt7915 for the corresponding copy of the code. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") See-also: 988845c9361a ("mt76: mt7915: add support for passing chip/firmware debug data to user space") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20221215163133.4152299-1-arnd@kernel.org
2022-12-09wifi: mt76: mt7915: get rid of wed rx_buf_ring page_frag_cacheLorenzo Bianconi
Since wed rx_buf_ring page_frag_cache is no longer used in a hot path, remove it and rely on page allocation APIs in mt7915_mmio_wed_init_rx_buf() and mt7915_mmio_wed_release_rx_buf() Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7921: resource leaks at mt7921_check_offload_capability()Sean Wang
Fixed coverity issue with resource leaks at variable "fw" going out of scope leaks the storage it points to mt7921_check_offload_capability(). Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1527806 ("Resource leaks") Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: dma: rely on queue page_frag_cache for wed rx queuesLorenzo Bianconi
Since mt76_dma_rx_fill() acquires mt76_queue spinlock, rely on mt76_queue page_frag_cache in mt76_dma_rx_fill() instead of wed rx_buf_ring page_frag_cache. Get rid of mt76_dma_rx_get_frag_cache since it is no longer used. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: handle possible mt76_rx_token_consume failuresLorenzo Bianconi
Take into account possible error conditions of mt76_rx_token_consume routine in mt7915_mmio_wed_init_rx_buf() and mt76_dma_add_buf() Fixes: cd372b8c99c5 ("wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf") Fixes: 4f831d18d12d ("wifi: mt76: mt7915: enable WED RX support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: dma: do not increment queue head if mt76_dma_add_buf failsLorenzo Bianconi
Do not increment queue head if mt76_dma_add_buf fails for Wireless Ethernet Dispatcher rx queues. Fixes: cd372b8c99c5 ("wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7615: enable per-phy led supportLorenzo Bianconi
Introduce the capability to support per-phy led blinking. This is needed for devices supporting dbdc. Co-developed-by: Ryder Lee <ryder.Lee@mediatek.com> Signed-off-by: Ryder Lee <ryder.Lee@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7915: enable per-phy led supportLorenzo Bianconi
Introduce the capability to support per-phy led blinking. This is needed for devices supporting dbdc. Tested-by: Frank Wunderlich <frank-w@public-files.de> Co-developed-by: Ryder Lee <ryder.Lee@mediatek.com> Signed-off-by: Ryder Lee <ryder.Lee@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: move leds struct in mt76_phyLorenzo Bianconi
Move leds struct in mt76_phy in order to have leds associated to phy (e.g. in dbdc mode) instead of per device. Tested-by: Frank Wunderlich <frank-w@public-files.de> Co-developed-by: Ryder Lee <ryder.Lee@mediatek.com> Signed-off-by: Ryder Lee <ryder.Lee@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: move leds field in leds structLorenzo Bianconi
This is a preliminary patch to support per-phy leds. Tested-by: Frank Wunderlich <frank-w@public-files.de> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: fix coverity uninit_use_in_call in ↵Deren Wu
mt76_connac2_reverse_frag0_hdr_trans() The default case for frame_contorl is invalid. We should always assign addr3 of this frame properly. Coverity error message: if (ieee80211_has_a4(hdr.frame_control)) (19) Event uninit_use_in_call: Using uninitialized value "hdr". Field "hdr.addr3" is uninitialized when calling "memcpy". memcpy(skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr)); else memcpy(skb_push(skb, sizeof(hdr) - 6), &hdr, sizeof(hdr) - 6); Fixes: 0880d40871d1 ("mt76: connac: move mt76_connac2_reverse_frag0_hdr_trans in mt76-connac module") Signed-off-by: Deren Wu <deren.wu@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read()Ryder Lee
In the expression "map[i].qid << 24" starts as u8, but is promoted to "signed int", then sign-extended to type "unsigned long", which is not intended. Cast to u32 to avoid the sign extension. Fixes: 776ec4e77aa6 ("mt76: mt7915: rework debugfs queue info") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read()Ryder Lee
In the expression "map[i].qid << 24" starts as u8, but is promoted to "signed int", then sign-extended to type "unsigned long", which is not intended. Cast to u32 to avoid the sign extension. Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1527813 ("Integer handling issues") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7921: add support to update fw capability with MTFG tableQuan Zhou
In ACPI enabled devices, mt7921 should read MTFG table from platform hardware. Apply necessary settings for firmware capabilities through CLC command. Co-developed-by: Deren Wu <deren.wu@mediatek.com> Signed-off-by: Deren Wu <deren.wu@mediatek.com> Signed-off-by: Quan Zhou <quan.zhou@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_powerLorenzo Bianconi
After 'commit ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}. Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine. Fixes: ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7996: fix endianness warning in mt7996_mcu_sta_he_tlvLorenzo Bianconi
Fix the following sparse warnings in mt7996_mcu_sta_he_tlv routine: warning: incorrect type in assignment (different base types) expected unsigned char got restricted __le16 [usertype] warning: incorrect type in assignment (different base types) expected unsigned char got restricted __le16 [usertype] Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7996: drop always true condition of __mt7996_reg_addr()Ryder Lee
addr <= MT_CBTOP2_PHY_END(0xffffffff) is always true (<= u32max), so drop it. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr()Ryder Lee
smatch warnings: addr <= MT_CBTOP2_PHY_END(0xffffffff) is always true (<= u32max), so drop it. Fixes: cd4c314a65d3 ("mt76: mt7915: refine register definition") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7915: check the correctness of event dataRyder Lee
The mcu event might not be reliable, so check the correctness of data before handling it. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7996: check return value before accessing free_block_numRyder Lee
Check return value of mt7996_mcu_get_eeprom_free_block() first before accessing free_block_num. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7915: check return value before accessing free_block_numRyder Lee
Check return value of mt7915_mcu_get_eeprom_free_block() first before accessing free_block_num. Fixes: bbc1d4154ec1 ("mt76: mt7915: add default calibrated data support") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7915: split mcu chan_mib array upRyder Lee
The current flow confuses coverity check that leads to false reporting, so split the offs[] into two pieces according to chipset revision to silence coverity tool. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7996: fix integer handling issue of mt7996_rf_regval_set()Ryder Lee
This code is supposed to set a u32 value, but casting will not work on big endian systems. Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1527816 ("Integer handling issues") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_rx_radar_detected()Ryder Lee
Coverity message: using tainted "r->band_idx" variable as an index into an array "(*dev).mt76.phys". Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1527812 ("Insecure data handling") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_ie_countdown()Ryder Lee
Coverity message: using tainted "hdr->band" variable as an index into an array "(*dev).mt76.phys". Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1527797 ("Insecure data handling") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaksRyder Lee
Coverity message: variable "buf" going out of scope leaks the storage. Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 1527799 ("Resource leaks") Fixes: e3296759f347 ("wifi: mt76: mt7915: enable per bandwidth power limit support") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio hostDeren Wu
SDIO may need addtional 511 bytes to align bus operation. If the tailroom of this skb is not big enough, we would access invalid memory region. For low level operation, increase skb size to keep valid memory access in SDIO host. Error message: [69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0 [69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451 [69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1 [69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300] [69.951] Call Trace: [69.951] <TASK> [69.952] dump_stack_lvl+0x49/0x63 [69.952] print_report+0x171/0x4a8 [69.952] kasan_report+0xb4/0x130 [69.952] kasan_check_range+0x149/0x1e0 [69.952] memcpy+0x24/0x70 [69.952] sg_copy_buffer+0xe9/0x1a0 [69.952] sg_copy_to_buffer+0x12/0x20 [69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300] [69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300] [69.952] process_one_work+0x7ee/0x1320 [69.952] worker_thread+0x53c/0x1240 [69.952] kthread+0x2b8/0x370 [69.952] ret_from_fork+0x1f/0x30 [69.952] </TASK> [69.952] Allocated by task 854: [69.952] kasan_save_stack+0x26/0x50 [69.952] kasan_set_track+0x25/0x30 [69.952] kasan_save_alloc_info+0x1b/0x30 [69.952] __kasan_kmalloc+0x87/0xa0 [69.952] __kmalloc_node_track_caller+0x63/0x150 [69.952] kmalloc_reserve+0x31/0xd0 [69.952] __alloc_skb+0xfc/0x2b0 [69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76] [69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76] [69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76] [69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib] [69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib] [69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common] [69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s] [69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common] [69.953] process_one_work+0x7ee/0x1320 [69.953] worker_thread+0x53c/0x1240 [69.953] kthread+0x2b8/0x370 [69.953] ret_from_fork+0x1f/0x30 [69.953] The buggy address belongs to the object at ffff88811c9ce800 which belongs to the cache kmalloc-2k of size 2048 [69.953] The buggy address is located 0 bytes to the right of 2048-byte region [ffff88811c9ce800, ffff88811c9cf000) [69.953] Memory state around the buggy address: [69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [69.953] ^ [69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Fixes: 764dee47e2c1 ("mt76: sdio: move common code in mt76_sdio module") Suggested-by: Lorenzo Bianconi <lorenzo@kernel.org> Tested-by: YN Chen <YN.Chen@mediatek.com> Signed-off-by: Deren Wu <deren.wu@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-12-09wifi: mt76: mt7915: add missing of_node_put()Wang Yufen
Add missing of_node_put() after of_reserved_mem_lookup() Fixes: 99ad32a4ca3a ("mt76: mt7915: add support for MT7986") Signed-off-by: Wang Yufen <wangyufen@huawei.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
generated by cgit (git 2.34.1) at 2025-09-23 11:10:50 +0000