Skip to content

Commit 6668c6f

Browse files
kuba-mookuba-moo
committed
Johannes Berg says: ==================== A good number of fixes: - cfg80211: - cancel rfkill work appropriately - fix radiotap parsing to correctly reject field 18 - fix wext (yes...) off-by-one for IGTK key ID - mac80211: - fix for mesh NULL pointer dereference - fix for stack out-of-bounds (2 bytes) write on specific multi-link action frames - set default WMM parameters for all links - mwifiex: check dev_alloc_name() return value correctly - libertas: fix potential timer use-after-free - brcmfmac: fix crash on probe failure * tag 'wireless-2026-02-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration wifi: mac80211: set default WMM parameters on all links wifi: libertas: fix use-after-free in lbs_free_adapter() wifi: mwifiex: Fix dev_alloc_name() return value check wifi: brcmfmac: Fix potential kernel oops when probe fails wifi: radiotap: reject radiotap with unknown bits wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() wifi: cfg80211: wext: fix IGTK key ID off-by-one ==================== Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2 parents 77da712 + 017c179 commit 6668c6f

11 files changed

Lines changed: 23 additions & 14 deletions

File tree

‎drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -951,11 +951,10 @@ int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
951951
goto out;
952952

953953
/* try to attach to the target device */
954-
sdiodev->bus = brcmf_sdio_probe(sdiodev);
955-
if (IS_ERR(sdiodev->bus)) {
956-
ret = PTR_ERR(sdiodev->bus);
954+
ret = brcmf_sdio_probe(sdiodev);
955+
if (ret)
957956
goto out;
958-
}
957+
959958
brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
960959
out:
961960
if (ret)

‎drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4445,7 +4445,7 @@ brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus)
44454445
return fwreq;
44464446
}
44474447

4448-
struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
4448+
int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
44494449
{
44504450
int ret;
44514451
struct brcmf_sdio *bus;
@@ -4551,11 +4551,12 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
45514551
goto fail;
45524552
}
45534553

4554-
return bus;
4554+
return 0;
45554555

45564556
fail:
45574557
brcmf_sdio_remove(bus);
4558-
return ERR_PTR(ret);
4558+
sdiodev->bus = NULL;
4559+
return ret;
45594560
}
45604561

45614562
/* Detach and free everything */

‎drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ void brcmf_sdiod_freezer_uncount(struct brcmf_sdio_dev *sdiodev);
358358
int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev);
359359
int brcmf_sdiod_remove(struct brcmf_sdio_dev *sdiodev);
360360

361-
struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
361+
int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
362362
void brcmf_sdio_remove(struct brcmf_sdio *bus);
363363
void brcmf_sdio_isr(struct brcmf_sdio *bus, bool in_isr);
364364

‎drivers/net/wireless/marvell/libertas/main.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -799,8 +799,8 @@ static void lbs_free_adapter(struct lbs_private *priv)
799799
{
800800
lbs_free_cmd_buffer(priv);
801801
kfifo_free(&priv->event_fifo);
802-
timer_delete(&priv->command_timer);
803-
timer_delete(&priv->tx_lockup_timer);
802+
timer_delete_sync(&priv->command_timer);
803+
timer_delete_sync(&priv->tx_lockup_timer);
804804
}
805805

806806
static const struct net_device_ops lbs_netdev_ops = {

‎drivers/net/wireless/marvell/mwifiex/cfg80211.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3148,7 +3148,7 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
31483148
SET_NETDEV_DEV(dev, adapter->dev);
31493149

31503150
ret = dev_alloc_name(dev, name);
3151-
if (ret)
3151+
if (ret < 0)
31523152
goto err_alloc_name;
31533153

31543154
priv->dfs_cac_workqueue = alloc_workqueue("MWIFIEX_DFS_CAC-%s",

‎net/mac80211/link.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,
281281
struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS];
282282
struct ieee80211_link_data *old_data[IEEE80211_MLD_MAX_NUM_LINKS];
283283
bool use_deflink = old_links == 0; /* set for error case */
284+
bool non_sta = sdata->vif.type != NL80211_IFTYPE_STATION;
284285

285286
lockdep_assert_wiphy(sdata->local->hw.wiphy);
286287

@@ -337,6 +338,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,
337338
link = links[link_id];
338339
ieee80211_link_init(sdata, link_id, &link->data, &link->conf);
339340
ieee80211_link_setup(&link->data);
341+
ieee80211_set_wmm_default(&link->data, true, non_sta);
340342
}
341343

342344
if (new_links == 0)

‎net/mac80211/mesh.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1636,6 +1636,9 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
16361636
if (!mesh_matches_local(sdata, elems))
16371637
goto free;
16381638

1639+
if (!elems->mesh_chansw_params_ie)
1640+
goto free;
1641+
16391642
ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
16401643
if (!--ifmsh->chsw_ttl)
16411644
fwd_csa = false;

‎net/mac80211/mlme.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7085,6 +7085,9 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
70857085
control = le16_to_cpu(prof->control);
70867086
link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID;
70877087

7088+
if (link_id >= IEEE80211_MLD_MAX_NUM_LINKS)
7089+
continue;
7090+
70887091
removed_links |= BIT(link_id);
70897092

70907093
/* the MAC address should not be included, but handle it */

‎net/wireless/core.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1212,6 +1212,7 @@ void wiphy_unregister(struct wiphy *wiphy)
12121212
/* this has nothing to do now but make sure it's gone */
12131213
cancel_work_sync(&rdev->wiphy_work);
12141214

1215+
cancel_work_sync(&rdev->rfkill_block);
12151216
cancel_work_sync(&rdev->conn_work);
12161217
flush_work(&rdev->event_work);
12171218
cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);

‎net/wireless/radiotap.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -239,14 +239,14 @@ int ieee80211_radiotap_iterator_next(
239239
default:
240240
if (!iterator->current_namespace ||
241241
iterator->_arg_index >= iterator->current_namespace->n_bits) {
242-
if (iterator->current_namespace == &radiotap_ns)
243-
return -ENOENT;
244242
align = 0;
245243
} else {
246244
align = iterator->current_namespace->align_size[iterator->_arg_index].align;
247245
size = iterator->current_namespace->align_size[iterator->_arg_index].size;
248246
}
249247
if (!align) {
248+
if (iterator->current_namespace == &radiotap_ns)
249+
return -ENOENT;
250250
/* skip all subsequent data */
251251
iterator->_arg = iterator->_next_ns_data;
252252
/* give up on this namespace */

0 commit comments

Comments
 (0)