mirror of
https://github.com/coolsnowwolf/lede.git
synced 2025-04-16 14:23:38 +00:00
d05fbef769
* mac80211: backport security fixes
This mainly affects scanning and beacon parsing, especially with MBSSID enabled
Fixes: CVE-2022-41674
Fixes: CVE-2022-42719
Fixes: CVE-2022-42720
Fixes: CVE-2022-42721
Fixes: CVE-2022-42722
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 26f400210d6b3780fcc0deb89b9741837df9c8b8)
* mac80211: refresh patches
355-wifi-cfg80211-fix-BSS-refcounting-bugs.patch - 5a52384a51
Co-authored-by: Felix Fietkau <nbd@nbd.name>
Co-authored-by: 1054009064 <1054009064@users.noreply.github.com>
61 lines
1.7 KiB
Diff
61 lines
1.7 KiB
Diff
--- a/drivers/net/wireless/realtek/rtw88/coex.c
|
|
+++ b/drivers/net/wireless/realtek/rtw88/coex.c
|
|
@@ -606,7 +606,7 @@ static struct sk_buff *rtw_coex_info_req
|
|
struct rtw_coex *coex = &rtwdev->coex;
|
|
struct sk_buff *skb_resp = NULL;
|
|
|
|
- mutex_lock(&coex->mutex);
|
|
+ lockdep_assert_held(&rtwdev->mutex);
|
|
|
|
rtw_fw_query_bt_mp_info(rtwdev, req);
|
|
|
|
@@ -623,7 +623,6 @@ static struct sk_buff *rtw_coex_info_req
|
|
}
|
|
|
|
out:
|
|
- mutex_unlock(&coex->mutex);
|
|
return skb_resp;
|
|
}
|
|
|
|
--- a/drivers/net/wireless/realtek/rtw88/debug.c
|
|
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
|
|
@@ -794,7 +794,9 @@ static int rtw_debugfs_get_coex_info(str
|
|
struct rtw_debugfs_priv *debugfs_priv = m->private;
|
|
struct rtw_dev *rtwdev = debugfs_priv->rtwdev;
|
|
|
|
+ mutex_lock(&rtwdev->mutex);
|
|
rtw_coex_display_coex_info(rtwdev, m);
|
|
+ mutex_unlock(&rtwdev->mutex);
|
|
|
|
return 0;
|
|
}
|
|
--- a/drivers/net/wireless/realtek/rtw88/main.c
|
|
+++ b/drivers/net/wireless/realtek/rtw88/main.c
|
|
@@ -1843,7 +1843,6 @@ int rtw_core_init(struct rtw_dev *rtwdev
|
|
spin_lock_init(&rtwdev->tx_report.q_lock);
|
|
|
|
mutex_init(&rtwdev->mutex);
|
|
- mutex_init(&rtwdev->coex.mutex);
|
|
mutex_init(&rtwdev->hal.tx_power_mutex);
|
|
|
|
init_waitqueue_head(&rtwdev->coex.wait);
|
|
@@ -1910,7 +1909,6 @@ void rtw_core_deinit(struct rtw_dev *rtw
|
|
}
|
|
|
|
mutex_destroy(&rtwdev->mutex);
|
|
- mutex_destroy(&rtwdev->coex.mutex);
|
|
mutex_destroy(&rtwdev->hal.tx_power_mutex);
|
|
}
|
|
EXPORT_SYMBOL(rtw_core_deinit);
|
|
--- a/drivers/net/wireless/realtek/rtw88/main.h
|
|
+++ b/drivers/net/wireless/realtek/rtw88/main.h
|
|
@@ -1429,8 +1429,6 @@ struct rtw_coex_stat {
|
|
};
|
|
|
|
struct rtw_coex {
|
|
- /* protects coex info request section */
|
|
- struct mutex mutex;
|
|
struct sk_buff_head queue;
|
|
wait_queue_head_t wait;
|
|
|