mirror of
https://github.com/coolsnowwolf/lede.git
synced 2025-04-16 04:13:31 +00:00
d05fbef769
* mac80211: backport security fixes
This mainly affects scanning and beacon parsing, especially with MBSSID enabled
Fixes: CVE-2022-41674
Fixes: CVE-2022-42719
Fixes: CVE-2022-42720
Fixes: CVE-2022-42721
Fixes: CVE-2022-42722
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 26f400210d6b3780fcc0deb89b9741837df9c8b8)
* mac80211: refresh patches
355-wifi-cfg80211-fix-BSS-refcounting-bugs.patch - 5a52384a51
Co-authored-by: Felix Fietkau <nbd@nbd.name>
Co-authored-by: 1054009064 <1054009064@users.noreply.github.com>
110 lines
3.3 KiB
Diff
110 lines
3.3 KiB
Diff
--- a/drivers/net/wireless/realtek/rtw88/debug.c
|
|
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
|
|
@@ -143,7 +143,9 @@ static int rtw_debugfs_get_rf_read(struc
|
|
addr = debugfs_priv->rf_addr;
|
|
mask = debugfs_priv->rf_mask;
|
|
|
|
+ mutex_lock(&rtwdev->mutex);
|
|
val = rtw_read_rf(rtwdev, path, addr, mask);
|
|
+ mutex_unlock(&rtwdev->mutex);
|
|
|
|
seq_printf(m, "rf_read path:%d addr:0x%08x mask:0x%08x val=0x%08x\n",
|
|
path, addr, mask, val);
|
|
@@ -401,7 +403,9 @@ static ssize_t rtw_debugfs_set_rf_write(
|
|
return count;
|
|
}
|
|
|
|
+ mutex_lock(&rtwdev->mutex);
|
|
rtw_write_rf(rtwdev, path, addr, mask, val);
|
|
+ mutex_unlock(&rtwdev->mutex);
|
|
rtw_dbg(rtwdev, RTW_DBG_DEBUGFS,
|
|
"write_rf path:%d addr:0x%08x mask:0x%08x, val:0x%08x\n",
|
|
path, addr, mask, val);
|
|
@@ -481,6 +485,8 @@ static int rtw_debug_get_rf_dump(struct
|
|
u32 addr, offset, data;
|
|
u8 path;
|
|
|
|
+ mutex_lock(&rtwdev->mutex);
|
|
+
|
|
for (path = 0; path < rtwdev->hal.rf_path_num; path++) {
|
|
seq_printf(m, "RF path:%d\n", path);
|
|
for (addr = 0; addr < 0x100; addr += 4) {
|
|
@@ -495,6 +501,8 @@ static int rtw_debug_get_rf_dump(struct
|
|
seq_puts(m, "\n");
|
|
}
|
|
|
|
+ mutex_unlock(&rtwdev->mutex);
|
|
+
|
|
return 0;
|
|
}
|
|
|
|
@@ -911,6 +919,8 @@ static void dump_gapk_status(struct rtw_
|
|
dm_info->dm_flags & BIT(RTW_DM_CAP_TXGAPK) ? '-' : '+',
|
|
rtw_dm_cap_strs[RTW_DM_CAP_TXGAPK]);
|
|
|
|
+ mutex_lock(&rtwdev->mutex);
|
|
+
|
|
for (path = 0; path < rtwdev->hal.rf_path_num; path++) {
|
|
val = rtw_read_rf(rtwdev, path, RF_GAINTX, RFREG_MASK);
|
|
seq_printf(m, "path %d:\n0x%x = 0x%x\n", path, RF_GAINTX, val);
|
|
@@ -920,6 +930,7 @@ static void dump_gapk_status(struct rtw_
|
|
txgapk->rf3f_fs[path][i], i);
|
|
seq_puts(m, "\n");
|
|
}
|
|
+ mutex_unlock(&rtwdev->mutex);
|
|
}
|
|
|
|
static int rtw_debugfs_get_dm_cap(struct seq_file *m, void *v)
|
|
--- a/drivers/net/wireless/realtek/rtw88/hci.h
|
|
+++ b/drivers/net/wireless/realtek/rtw88/hci.h
|
|
@@ -166,12 +166,11 @@ static inline u32
|
|
rtw_read_rf(struct rtw_dev *rtwdev, enum rtw_rf_path rf_path,
|
|
u32 addr, u32 mask)
|
|
{
|
|
- unsigned long flags;
|
|
u32 val;
|
|
|
|
- spin_lock_irqsave(&rtwdev->rf_lock, flags);
|
|
+ lockdep_assert_held(&rtwdev->mutex);
|
|
+
|
|
val = rtwdev->chip->ops->read_rf(rtwdev, rf_path, addr, mask);
|
|
- spin_unlock_irqrestore(&rtwdev->rf_lock, flags);
|
|
|
|
return val;
|
|
}
|
|
@@ -180,11 +179,9 @@ static inline void
|
|
rtw_write_rf(struct rtw_dev *rtwdev, enum rtw_rf_path rf_path,
|
|
u32 addr, u32 mask, u32 data)
|
|
{
|
|
- unsigned long flags;
|
|
+ lockdep_assert_held(&rtwdev->mutex);
|
|
|
|
- spin_lock_irqsave(&rtwdev->rf_lock, flags);
|
|
rtwdev->chip->ops->write_rf(rtwdev, rf_path, addr, mask, data);
|
|
- spin_unlock_irqrestore(&rtwdev->rf_lock, flags);
|
|
}
|
|
|
|
static inline u32
|
|
--- a/drivers/net/wireless/realtek/rtw88/main.c
|
|
+++ b/drivers/net/wireless/realtek/rtw88/main.c
|
|
@@ -1839,7 +1839,6 @@ int rtw_core_init(struct rtw_dev *rtwdev
|
|
skb_queue_head_init(&rtwdev->coex.queue);
|
|
skb_queue_head_init(&rtwdev->tx_report.queue);
|
|
|
|
- spin_lock_init(&rtwdev->rf_lock);
|
|
spin_lock_init(&rtwdev->h2c.lock);
|
|
spin_lock_init(&rtwdev->txq_lock);
|
|
spin_lock_init(&rtwdev->tx_report.q_lock);
|
|
--- a/drivers/net/wireless/realtek/rtw88/main.h
|
|
+++ b/drivers/net/wireless/realtek/rtw88/main.h
|
|
@@ -1842,9 +1842,6 @@ struct rtw_dev {
|
|
/* ensures exclusive access from mac80211 callbacks */
|
|
struct mutex mutex;
|
|
|
|
- /* read/write rf register */
|
|
- spinlock_t rf_lock;
|
|
-
|
|
/* watch dog every 2 sec */
|
|
struct delayed_work watch_dog_work;
|
|
u32 watch_dog_cnt;
|