Commit Graph

3735 Commits

Author SHA1 Message Date
Kees Cook 6da2ec5605 treewide: kmalloc() -> kmalloc_array()
The kmalloc() function has a 2-factor argument form, kmalloc_array(). This
patch replaces cases of:

        kmalloc(a * b, gfp)

with:
        kmalloc_array(a * b, gfp)

as well as handling cases of:

        kmalloc(a * b * c, gfp)

with:

        kmalloc(array3_size(a, b, c), gfp)

as it's slightly less ugly than:

        kmalloc_array(array_size(a, b), c, gfp)

This does, however, attempt to ignore constant size factors like:

        kmalloc(4 * 1024, gfp)

though any constants defined via macros get caught up in the conversion.

Any factors with a sizeof() of "unsigned char", "char", and "u8" were
dropped, since they're redundant.

The tools/ directory was manually excluded, since it has its own
implementation of kmalloc().

The Coccinelle script used for this was:

// Fix redundant parens around sizeof().
@@
type TYPE;
expression THING, E;
@@

(
  kmalloc(
-	(sizeof(TYPE)) * E
+	sizeof(TYPE) * E
  , ...)
|
  kmalloc(
-	(sizeof(THING)) * E
+	sizeof(THING) * E
  , ...)
)

// Drop single-byte sizes and redundant parens.
@@
expression COUNT;
typedef u8;
typedef __u8;
@@

(
  kmalloc(
-	sizeof(u8) * (COUNT)
+	COUNT
  , ...)
|
  kmalloc(
-	sizeof(__u8) * (COUNT)
+	COUNT
  , ...)
|
  kmalloc(
-	sizeof(char) * (COUNT)
+	COUNT
  , ...)
|
  kmalloc(
-	sizeof(unsigned char) * (COUNT)
+	COUNT
  , ...)
|
  kmalloc(
-	sizeof(u8) * COUNT
+	COUNT
  , ...)
|
  kmalloc(
-	sizeof(__u8) * COUNT
+	COUNT
  , ...)
|
  kmalloc(
-	sizeof(char) * COUNT
+	COUNT
  , ...)
|
  kmalloc(
-	sizeof(unsigned char) * COUNT
+	COUNT
  , ...)
)

// 2-factor product with sizeof(type/expression) and identifier or constant.
@@
type TYPE;
expression THING;
identifier COUNT_ID;
constant COUNT_CONST;
@@

(
- kmalloc
+ kmalloc_array
  (
-	sizeof(TYPE) * (COUNT_ID)
+	COUNT_ID, sizeof(TYPE)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(TYPE) * COUNT_ID
+	COUNT_ID, sizeof(TYPE)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(TYPE) * (COUNT_CONST)
+	COUNT_CONST, sizeof(TYPE)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(TYPE) * COUNT_CONST
+	COUNT_CONST, sizeof(TYPE)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(THING) * (COUNT_ID)
+	COUNT_ID, sizeof(THING)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(THING) * COUNT_ID
+	COUNT_ID, sizeof(THING)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(THING) * (COUNT_CONST)
+	COUNT_CONST, sizeof(THING)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(THING) * COUNT_CONST
+	COUNT_CONST, sizeof(THING)
  , ...)
)

// 2-factor product, only identifiers.
@@
identifier SIZE, COUNT;
@@

- kmalloc
+ kmalloc_array
  (
-	SIZE * COUNT
+	COUNT, SIZE
  , ...)

// 3-factor product with 1 sizeof(type) or sizeof(expression), with
// redundant parens removed.
@@
expression THING;
identifier STRIDE, COUNT;
type TYPE;
@@

(
  kmalloc(
-	sizeof(TYPE) * (COUNT) * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  kmalloc(
-	sizeof(TYPE) * (COUNT) * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  kmalloc(
-	sizeof(TYPE) * COUNT * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  kmalloc(
-	sizeof(TYPE) * COUNT * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  kmalloc(
-	sizeof(THING) * (COUNT) * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  kmalloc(
-	sizeof(THING) * (COUNT) * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  kmalloc(
-	sizeof(THING) * COUNT * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  kmalloc(
-	sizeof(THING) * COUNT * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
)

// 3-factor product with 2 sizeof(variable), with redundant parens removed.
@@
expression THING1, THING2;
identifier COUNT;
type TYPE1, TYPE2;
@@

(
  kmalloc(
-	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
+	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
  , ...)
|
  kmalloc(
-	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
  , ...)
|
  kmalloc(
-	sizeof(THING1) * sizeof(THING2) * COUNT
+	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
  , ...)
|
  kmalloc(
-	sizeof(THING1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
  , ...)
|
  kmalloc(
-	sizeof(TYPE1) * sizeof(THING2) * COUNT
+	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
  , ...)
|
  kmalloc(
-	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
  , ...)
)

// 3-factor product, only identifiers, with redundant parens removed.
@@
identifier STRIDE, SIZE, COUNT;
@@

(
  kmalloc(
-	(COUNT) * STRIDE * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kmalloc(
-	COUNT * (STRIDE) * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kmalloc(
-	COUNT * STRIDE * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kmalloc(
-	(COUNT) * (STRIDE) * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kmalloc(
-	COUNT * (STRIDE) * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kmalloc(
-	(COUNT) * STRIDE * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kmalloc(
-	(COUNT) * (STRIDE) * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kmalloc(
-	COUNT * STRIDE * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
)

// Any remaining multi-factor products, first at least 3-factor products,
// when they're not all constants...
@@
expression E1, E2, E3;
constant C1, C2, C3;
@@

(
  kmalloc(C1 * C2 * C3, ...)
|
  kmalloc(
-	(E1) * E2 * E3
+	array3_size(E1, E2, E3)
  , ...)
|
  kmalloc(
-	(E1) * (E2) * E3
+	array3_size(E1, E2, E3)
  , ...)
|
  kmalloc(
-	(E1) * (E2) * (E3)
+	array3_size(E1, E2, E3)
  , ...)
|
  kmalloc(
-	E1 * E2 * E3
+	array3_size(E1, E2, E3)
  , ...)
)

// And then all remaining 2 factors products when they're not all constants,
// keeping sizeof() as the second factor argument.
@@
expression THING, E1, E2;
type TYPE;
constant C1, C2, C3;
@@

(
  kmalloc(sizeof(THING) * C2, ...)
|
  kmalloc(sizeof(TYPE) * C2, ...)
|
  kmalloc(C1 * C2 * C3, ...)
|
  kmalloc(C1 * C2, ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(TYPE) * (E2)
+	E2, sizeof(TYPE)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(TYPE) * E2
+	E2, sizeof(TYPE)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(THING) * (E2)
+	E2, sizeof(THING)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	sizeof(THING) * E2
+	E2, sizeof(THING)
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	(E1) * E2
+	E1, E2
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	(E1) * (E2)
+	E1, E2
  , ...)
|
- kmalloc
+ kmalloc_array
  (
-	E1 * E2
+	E1, E2
  , ...)
)

Signed-off-by: Kees Cook <keescook@chromium.org>
2018-06-12 16:19:22 -07:00
David S. Miller f624434a0e wireless-drivers-next patches for 4.18
Hopefully the last pull request to 4.18 before the merge window.
 Nothing major here, we have smaller new features and of course a lots
 of fixes.
 
 Major changes:
 
 ath10k
 
 * add memory dump support for QCA9888 and QCA99X0
 
 * add support to configure channel dwell time
 
 * support new DFS host confirmation feature in the firmware
 
 ath
 
 * update various regulatory mappings
 
 wcn36xx
 
 * various fixes to improve reliability
 
 * add Factory Test Mode support
 
 brmfmac
 
 * add debugfs file for reading firmware capabilities
 
 mwifiex
 
 * support sysfs initiated device coredump
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJbD/3rAAoJEG4XJFUm622b1ZwH/1xe1IqcwJXzfoDsYPlXVnSh
 TiLExjKkD0ty5M0//844FxpxE1sSYJKOJ11uz/COzyG2qi4+5lgpUdjnDoINuKfH
 ycqrXGssW7ogPWkVvnxKtlEYvkHNRYLQtxvd26umT77C69jVJLD0x9uihhh2En/C
 EKs+OK1Pp0SRvTfB4AblWzoAnpEe1wHJFFh4i3F5H0lMGxLQz/YjFl5aeAjjR406
 0vSKLGy2wKIydp8Pe4cAqBEeUWDJurn8ufkk7bmAET5zaXTH1qgZzLH3OWtx/ksz
 mcPQq9/ctv35G2917t3Sn69SIUCDGfYkP5DiZV+ti0Hz2gIV0zOg7mGYCU8uHaU=
 =11X5
 -----END PGP SIGNATURE-----

Merge tag 'wireless-drivers-next-for-davem-2018-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
wireless-drivers-next patches for 4.18

Hopefully the last pull request to 4.18 before the merge window.
Nothing major here, we have smaller new features and of course a lots
of fixes.

Major changes:

ath10k

* add memory dump support for QCA9888 and QCA99X0

* add support to configure channel dwell time

* support new DFS host confirmation feature in the firmware

ath

* update various regulatory mappings

wcn36xx

* various fixes to improve reliability

* add Factory Test Mode support

brmfmac

* add debugfs file for reading firmware capabilities

mwifiex

* support sysfs initiated device coredump
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-03 11:03:10 -04:00
Sriram R f40105e674 ath: add support to get the detected radar specifications
This enables ath10k/ath9k drivers to collect the specifications of the
radar type once it is detected by the dfs pattern detector unit.
Usage of the collected info is specific to driver implementation.
For example, collected radar info could be used by the host driver
to send to co-processors for additional processing/validation.

Note: 'radar_detector_specs' data containing the specifications of
different radar types which was private within dfs_pattern_detector/
dfs_pri_detector is now shared with drivers as well for making use
of this information.

Signed-off-by: Sriram R <srirrama@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-25 13:15:21 +03:00
Ilan Peer d4e36e5554 mac80211: Support adding duration for prepare_tx() callback
There are specific cases, such as SAE authentication exchange, that
might require long duration to complete. For such cases, add support
for indicating to the driver the required duration of the prepare_tx()
operation, so the driver would still be able to complete the frame
exchange.

Currently, indicate the duration only for SAE authentication exchange,
as SAE authentication can take up to 2000 msec (as defined in IEEE
P802.11-REVmd D1.0 p. 3504).

As the patch modified the prepare_tx() callback API, also modify
the relevant code in iwlwifi.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-05-23 11:06:10 +02:00
Kalle Valo 51c12756de Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
ath.git patches for 4.18. Major changes:

ath10k

* enable temperature reads for QCA6174 and QCA9377

* add firmware memory dump support for QCA9984

* continue adding WCN3990 support via SNOC bus
2018-04-25 11:30:54 +03:00
Gustavo A. R. Silva 9c27489a34 ath9k: dfs: remove accidental use of stack VLA
In preparation to enabling -Wvla, remove accidental use of stack VLA.

This avoids an accidental stack VLA (since the compiler thinks
the value of FFT_NUM_SAMPLES can change, even when marked
"const"). This just replaces it with a #define.

Also, fixed as part of the directive to remove all VLAs from
the kernel: https://lkml.org/lkml/2018/3/7/621

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-04-10 17:32:44 +03:00
Linus Torvalds 672a9c1069 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
Pull trivial tree updates from Jiri Kosina.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial:
  kfifo: fix inaccurate comment
  tools/thermal: tmon: fix for segfault
  net: Spelling s/stucture/structure/
  edd: don't spam log if no EDD information is present
  Documentation: Fix early-microcode.txt references after file rename
  tracing: Block comments should align the * on each line
  treewide: Fix typos in printk
  GenWQE: Fix a typo in two comments
  treewide: Align function definition open/close braces
2018-04-05 11:56:35 -07:00
Joe Perches a72c926291 ath: Remove unnecessary ath_bcast_mac and use eth_broadcast_addr
Remove the static array and use the generic routine to set the
Ethernet broadcast address.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-03-29 12:10:26 +03:00
Timothy Redaelli 4415d58c47 ath9k: fix DFS detector synchronization
some userspace programs (e.g. hostapd) need to set the regulatory domain
before selecting the operating channel. Synchronize DFS detector regardless of
the value of ah->curchan, to avoid situations where wireless scan can't be done
on some 5GHz sub-bands, because dfs_region is constantly UNSET.

Acked-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Timothy Redaelli <tredaelli@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-03-29 11:48:08 +03:00
Joe Perches 2ef00c5304 wireless: Use octal not symbolic permissions
Prefer the direct use of octal for permissions.

Done with checkpatch -f --types=SYMBOLIC_PERMS --fix-inplace
and some typing.

Miscellanea:

o Whitespace neatening around these conversions.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-03-27 11:01:13 +03:00
Kalle Valo abd5f00844 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
ath.git patches for 4.17. Major changes:

wil6210

* support multiple virtual interfaces
2018-03-27 10:06:18 +03:00
Peter Große 1fb148f51e ath9k: spelling s/premble/preamble/
Signed-off-by: Peter Große <pegro@friiks.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-03-26 18:22:44 +03:00
Sebastian Gottschall 221b6ec69e ath9k: fix crash in spectral scan
Fixes crash seen on arm smp systems (gateworks ventana imx6):

Unable to handle kernel NULL pointer dereference at virtual address 00000014
pgd = 80004000
[00000014] *pgd=00000000
Internal error: Oops - BUG: 17 [#1] PREEMPT SMP ARM
Modules linked in: ip6table_filter nf_conntrack_ipv6 ip6_tables nf_log_ipv6 nf_defrag_ipv6 shortcut_fe ipcomp6 xfrm_ipcomp xfrm6_tunnel xfrm6_mode_tunnel xfrm6_mode_transport xfrm6_mode_ro xfrm6_mode_beet ip6_tunnel tunnel6 mip6 ah6 esp6 xfrm_algo sit ip_tunnel tunnel4 ipv6 ath10k_pci ath10k_core ath9k ath mac80211 cfg80211 compat ath_pci ath_hal(P) caamalg authencesn authenc caamrng caamhash caam_jr caam cdc_ncm usbnet usbcore sky2 imx2_wdt
CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: P                4.9.85 #19
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
task: bf064980 task.stack: bf07c000
PC is at relay_buf_full+0xc/0x30
LR is at _674+0x740/0xf10 [ath9k]
pc : [<8018bce0>]    lr : [<7f1aa604>]    psr: 80000013
sp : bf07dbf0  ip : bf07dc00  fp : bf07dbfc
r10: 0000003f  r9 : bf130e00  r8 : 809044b0
r7 : 00000000  r6 : be67a9f0  r5 : 00000000  r4 : 809043e4
r3 : c0864c24  r2 : 00000000  r1 : 00000004  r0 : 00000000
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 4e6a004a  DAC: 00000055
Process ksoftirqd/0 (pid: 3, stack limit = 0xbf07c210)
Stack: (0xbf07dbf0 to 0xbf07e000)
dbe0:                                     bf07dd04 bf07dc00 7f1aa604 8018bce0
dc00: 00004014 be59e010 bf07dc34 bf07dc18 7f1a7084 7f19c07c be59c010 be6470a0
dc20: 0000096c be648954 bf07dc6c bf07dc38 7f1c286c bf07dd90 bf07dc5c bf07dc48
dc40: 8029ea4c 0000003c 00000001 be59c010 00000094 00000000 00000000 00000000
dc60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dc80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dca0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dcc0: 00000000 00000000 00000000 00000000 00000000 00000000 8010ef24 00000030
dce0: be94f5e8 be6485a0 bddf0200 be59c010 be6465a0 be6415a0 bf07ddf4 bf07dd08
dd00: 7f1cf800 7f1aa55c 1fc38c4c 00000000 bf07dd58 cccccccd 66666667 be640bc0
dd20: bf07dd54 be6415a0 1fc38c4c 00000000 00000000 be59c038 be67a9c0 be59e010
dd40: be67a9f0 be647170 8090c904 be59c010 00000000 00000001 1fc38e84 00000000
dd60: be640bc0 bddf0200 00000200 00000010 0000003f 00000002 20000013 be59c010
dd80: 8092d940 bf7ca2c0 bf07ddb4 bf07dd98 1fc38c4c 2602003f 0100ff1b 80ff1b00
dda0: 00808080 00000000 00000000 80808080 80808080 80808080 80808080 00008080
ddc0: 00000000 00000000 7f1b62b8 00000002 be6470ec be6470f0 00000000 bf07de98
dde0: 8092d940 be6415a0 bf07de94 bf07ddf8 7f1d1ed8 7f1cf1fc 00000000 00000000
de00: bf7cc4c0 00000400 be6470f0 bf07de18 8015165c be59c010 8090453c 8090453c
de20: bf07dec4 be6465a0 8014f614 80148884 0000619a 00000001 bf07c000 00000100
de40: bf07de78 00000001 7f327850 00000002 afb50401 bf064980 bf07de9c bf07de68
de60: bf064a00 803cc668 bf064a00 be6470b4 be6470b8 80844180 00000000 bf07de98
de80: 8092d940 bf07c000 bf07dec4 bf07de98 80124d18 7f1d1c44 80124c94 00000000
dea0: 00000006 80902098 80902080 40000006 00000100 bf07c000 bf07df24 bf07dec8
dec0: 8012501c 80124ca0 bf7cc4c0 bf064980 be95e1c0 04208040 80902d00 000061c7
dee0: 0000000a 80600b54 8092d940 808441f8 80902080 bf07dec8 bf03b200 bf07c000
df00: bf03b200 8090fe54 00000000 00000000 00000000 00000000 bf07df34 bf07df28
df20: 80125148 80124f28 bf07df5c bf07df38 8013deb4 8012511c 00000000 bf03b240
df40: bf03b200 8013dc90 00000000 00000000 bf07dfac bf07df60 8013ad40 8013dc9c
df60: 70448040 00000001 00000000 bf03b200 00000000 00030003 bf07df78 bf07df78
df80: 00000000 00000000 bf07df88 bf07df88 bf03b240 8013ac48 00000000 00000000
dfa0: 00000000 bf07dfb0 80107760 8013ac54 00000000 00000000 00000000 00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 8c120004 1190ad04
Backtrace:
[<8018bcd4>] (relay_buf_full) from [<7f1aa604>] (_674+0x740/0xf10 [ath9k])
[<7f1aa550>] (_674 [ath9k]) from [<7f1cf800>] (_582+0x14b4/0x3708 [ath9k])
 r10:be6415a0 r9:be6465a0 r8:be59c010 r7:bddf0200 r6:be6485a0 r5:be94f5e8
 r4:00000030
[<7f1cf1f0>] (_582 [ath9k]) from [<7f1d1ed8>] (_735+0x2a0/0xec4 [ath9k])
 r10:be6415a0 r9:8092d940 r8:bf07de98 r7:00000000 r6:be6470f0 r5:be6470ec
 r4:00000002
[<7f1d1c38>] (_735 [ath9k]) from [<80124d18>] (tasklet_action+0x84/0xf8)
 r10:bf07c000 r9:8092d940 r8:bf07de98 r7:00000000 r6:80844180 r5:be6470b8
 r4:be6470b4
[<80124c94>] (tasklet_action) from [<8012501c>] (__do_softirq+0x100/0x1f4)
 r10:bf07c000 r9:00000100 r8:40000006 r7:80902080 r6:80902098 r5:00000006
 r4:00000000 r3:80124c94
[<80124f1c>] (__do_softirq) from [<80125148>] (run_ksoftirqd+0x38/0x4c)
 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:8090fe54 r5:bf03b200
 r4:bf07c000
[<80125110>] (run_ksoftirqd) from [<8013deb4>] (smpboot_thread_fn+0x224/0x260)
[<8013dc90>] (smpboot_thread_fn) from [<8013ad40>] (kthread+0xf8/0x100)
 r9:00000000 r8:00000000 r7:8013dc90 r6:bf03b200 r5:bf03b240 r4:00000000
[<8013ac48>] (kthread) from [<80107760>] (ret_from_fork+0x14/0x34)
 r7:00000000 r6:00000000 r5:8013ac48 r4:bf03b240
Code: e89da800 e1a0c00d e92dd800 e24cb004 (e5901014)
---[ end trace dddf11ac9111b272 ]---
Kernel panic - not syncing: Fatal exception in interrupt
CPU1: stopping
CPU: 1 PID: 0 Comm: swapper/1 Tainted: P      D         4.9.85 #19
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
Backtrace:
[<8010a708>] (dump_backtrace) from [<8010a99c>] (show_stack+0x18/0x1c)
 r7:bf093f58 r6:20000193 r5:809168e8 r4:00000000
[<8010a984>] (show_stack) from [<802a09c4>] (dump_stack+0x94/0xa8)
[<802a0930>] (dump_stack) from [<8010d184>] (handle_IPI+0xe8/0x180)
 r7:bf093f58 r6:00000000 r5:00000001 r4:808478c4
[<8010d09c>] (handle_IPI) from [<801013e8>] (gic_handle_irq+0x78/0x7c)
 r7:f4000100 r6:bf093f58 r5:f400010c r4:8090467c
[<80101370>] (gic_handle_irq) from [<8010b378>] (__irq_svc+0x58/0x8c)
Exception stack(0xbf093f58 to 0xbf093fa0)
3f40:                                                       bf7d62a0 00000000
3f60: 0010a5f4 80113460 bf092000 809043e4 00000002 80904434 bf092008 412fc09a
3f80: 00000000 bf093fb4 bf093fb8 bf093fa8 8010804c 80108050 60000013 ffffffff
 r9:bf092000 r8:bf092008 r7:bf093f8c r6:ffffffff r5:60000013 r4:80108050
[<80108014>] (arch_cpu_idle) from [<80553c2c>] (default_idle_call+0x30/0x34)
[<80553bfc>] (default_idle_call) from [<80158394>] (cpu_startup_entry+0xc4/0xfc)
[<801582d0>] (cpu_startup_entry) from [<8010ce40>] (secondary_start_kernel+0x168/0x174)
 r7:8092d2f8 r4:80913568
[<8010ccd8>] (secondary_start_kernel) from [<10101488>] (0x10101488)
 r5:00000055 r4:4f07806a
Rebooting in 10 seconds..
Reboot failed -- System halted

Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-03-26 18:21:15 +03:00
Joe Perches 447a5647c9 treewide: Align function definition open/close braces
Some functions definitions have either the initial open brace and/or
the closing brace outside of column 1.

Move those braces to column 1.

This allows various function analyzers like gnu complexity to work
properly for these modified functions.

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Acked-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-03-26 11:13:09 +02:00
Johannes Berg 60b01bcce9 ath9k_htc: use non-QoS NDP for AP probing
When switching mac80211 to use QoS NDP, it turned out that
ath9k_htc is somehow broken by this, e.g. see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891060.

Fix this by using the new mac80211 flag to go back to the
old, incorrect, behaviour for this driver.

Fixes: 7b6ddeaf27 ("mac80211: use QoS NDP for AP probing")
Reported-by: Ben Caradoc-Davies <ben@transient.nz>
Acked-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-03-21 13:01:55 +01:00
Toke Høiland-Jørgensen 182b191710 ath9k: Protect queue draining by rcu_read_lock()
When ath9k was switched over to use the mac80211 intermediate queues,
node cleanup now drains the mac80211 queues. However, this call path is
not protected by rcu_read_lock() as it was previously entirely internal
to the driver which uses its own locking.

This leads to a possible rcu_dereference() without holding
rcu_read_lock(); but only if a station is cleaned up while having
packets queued on the TXQ. Fix this by adding the rcu_read_lock() to the
caller in ath9k.

Fixes: 50f08edf98 ("ath9k: Switch to using mac80211 intermediate software queues.")
Cc: stable@vger.kernel.org
Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-03-14 11:55:51 +02:00
Wojciech Dubowik 52c528ffaf ath9k: Fix ack SIFS time for quarter/half channels
Ack timing generation has to be adapted for 5/10 MHz channels.
Do it by properly initializing ack shift field in TXSIFS
register. Ack shift assumes channel width of 2.5 Mhz so
value zero means 2.5 MHz, 1 is 5 MHz and so on.

Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-02-27 18:47:29 +02:00
Wojciech Dubowik 91f1ee65d9 ath9k: Fix airtime calculation for quarter/half channels
The bitrate value for airtime calculation is specified for
full rates. We need to divide it for 5 and 10MHz channels to
get correct result.

Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-02-27 18:47:23 +02:00
Oleksij Rempel 4e12d654ba ath9k_htc: add Altai WA1011N-GU
as reported in:
https://github.com/qca/open-ath9k-htc-firmware/pull/71#issuecomment-361100070

Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-02-07 16:16:50 +02:00
Wojciech Dubowik b9607de6cf ath9k: Fix get channel default noise floor
Commit 8da58553cc ("ath9k: Use calibrated noise floor value
when available") introduced regression in ath9k_hw_getchan_noise
where per chain nominal noise floor has been taken instead default
for channel.
Revert to original default channel noise floor.

Fixes: 8da58553cc ("ath9k: Use calibrated noise floor value when available")
Reported-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-02-07 16:14:08 +02:00
Wojciech Dubowik 3717957ce5 ath9k: Display calibration data piers in debugfs
Display per frequency calibration data in dump_modal
debugfs entry including reference power, voltage,
tx temperature and noise floor.

Example of chain 0 of OEM card (dump from modal_eeprom):
Chain 0
Freq	 ref	volt	temp	nf_Cal	nf_Pow	rx_temp
5180	-30	0	137	0	0	0
5320	-24	0	137	0	0	0
5500	-15	0	137	0	0	0
5620	-10	0	137	0	0	0
5700	-15	0	137	0	0	0
5745	-16	0	135	0	0	0
5785	-19	0	136	0	0	0
5825	-22	0	136	0	0	0

Example of a card with calibrated noise floor.
Chain 0
Freq	 ref	volt	temp	nf_Cal	nf_Pow	rx_temp
4890	-49	0	128	-107	-97	124
5100	-23	0	128	-101	-96	124
5180	-18	0	128	-101	-96	124
5300	-12	0	128	-102	-97	124
5500	-9	0	128	-101	-97	125
5640	-17	0	128	-101	-98	124
5785	-25	0	128	-101	-98	124
5940	-33	0	128	-106	-99	124

Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-25 07:33:50 +02:00
Wojciech Dubowik 8da58553cc ath9k: Use calibrated noise floor value when available
AR9003 series allows to calibrate noise floor for different frequency
bins. Once it's done it's possible to get more accurate rssi/signal
values over whole frequency band at a given temperature.
The RSSI/signal accuracy reported by calibrated RF cards improves
from 6 to up to 2dB.

This could be interesting for application which require good signal
accuracy like roaming or mesh protocols.

Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-25 07:33:43 +02:00
Wojciech Dubowik 34d4fcd881 ath9k: Read noise floor calibration data from eeprom
AR9003 devices can have calibrated noise floor values
which can be used instead of hard coded one. Read them
from eeprom and save interpolated value in nf limits for
the current channel.

Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-25 07:33:36 +02:00
Wojciech Dubowik 528782ecf5 ath9k: Alternative EEPROM size for AR9003
AR9003 factory calibration allows to use bigger EEPROM than
standard 1k without changing the default layout. Allow
probing of EEPROM at alternative address if initial check
for default fails.
The original ar9003 eeprom ops are still be used.

Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-25 07:33:28 +02:00
Felix Fietkau 3c0efb745a ath9k: discard undersized packets
Sometimes the hardware will push small packets that trigger a WARN_ON
in mac80211. Discard them early to avoid this issue.

Reported-by: Stijn Tintel <stijn@linux-ipv6.be>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-25 07:30:49 +02:00
AceLan Kao 3153b68e4d ath9k: add a quirk to set use_msi automatically
Some platform(BIOS) blocks legacy interrupts (INTx), and only allows MSI
for WLAN device. So adding a quirk to list those machines and set
use_msi automatically.
Adding the following platforms to the quirk.
   Dell Inspiron 24-3460
   Dell Inspiron 3472
   Dell Inspiron 14-3473
   Dell Vostro 3262
   Dell Vostro 15-3572

Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-16 16:30:05 +02:00
Russell Hu 7368160f0a ath9k: add MSI support
On new Intel platforms like ApolloLake, legacy interrupt mechanism
(INTx) is not supported, so WLAN modules are not working because
interrupts are missing, therefore this patch is to add MSI support to
ath9k.  With module paremeter "use_msi=1", ath9k driver would try to
use MSI instead of INTx.

Signed-off-by: Russell Hu <rhu@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-16 16:29:22 +02:00
Dan Carpenter 413fd2f5c0 ath9k_htc: Add a sanity check in ath9k_htc_ampdu_action()
Smatch generates a warning here:

    drivers/net/wireless/ath/ath9k/htc_drv_main.c:1688 ath9k_htc_ampdu_action()
    error: buffer overflow 'ista->tid_state' 8 <= 15

I don't know if it's a real bug or not but the other paths through this
function all ensure that "tid" is less than ATH9K_HTC_MAX_TID (8) so
checking here makes things more consistent.

Fixes: fb9987d0f7 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-12-14 17:30:11 +02:00
Matthias Schiffer 9df7ddc3ed ath9k: move spectral scan support under a separate config symbol
At the moment, spectral scan support, and with it RELAY, is always enabled
with ATH9K[_HTC]_DEBUGFS. Spectral scan support is currently the only user
of RELAY in ath9k, and it unconditionally reserves a relay channel.

Having debugfs support in ath9k is often useful even on very small embedded
routers, where we'd rather like to avoid the code size and RAM usage of the
relay support.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-12-07 16:31:57 +02:00
Gustavo A. R. Silva 626ab6707a ath9k: dfs: use swap macro in ath9k_check_chirping
Make use of the swap macro and remove unnecessary variable temp.
This makes the code easier to read and maintain.

This code was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-12-02 16:12:53 +02:00
Johannes Berg 7b6ddeaf27 mac80211: use QoS NDP for AP probing
When connected to a QoS/WMM AP, mac80211 should use a QoS NDP
for probing it, instead of a regular non-QoS one, fix this.

Change all the drivers to *not* allow QoS NDP for now, even
though it looks like most of them should be OK with that.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-11-27 11:23:20 +01:00
David S. Miller 6e300769dc wireless-drivers-next patches for 4.15
Mostly fixes this time, but also few new features.
 
 Major changes:
 
 wil6210
 
 * remove ssid debugfs file
 
 rsi
 
 * add WOWLAN support for suspend, hibernate and shutdown states
 
 ath10k
 
 * add support for CCMP-256, GCMP and GCMP-256 ciphers on hardware
   where it's supported (QCA99x0 and QCA4019)
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJZ/HSCAAoJEG4XJFUm622b2sQH+wXgE1swS9xp1AfV3hcVLGoJ
 YjLjR3/BAxsIqkYwhswarTDrD3jsOKrL4ywRk+0BAdR7f2BeOYhQXtZqgjvE8cbu
 WWv5LmSwuKM6tF3ujgjQ6yZvgyDHl2d7lZL59EWG05K/yjJuU8ByoUhLKM5IiqPh
 SWXj3ZtydgGZm2eZTPyan+MFz91jw/X23Jm/AaIAxayf+1J4n1lNpc4rRhUxh/oy
 kGLQ2vsVnegSiHJWTboDFPeRha+daBsbf1MQc0Bh7MzDoWcaqSNX5VgrbaRqp35u
 sb9pmPZS4FzvAdU3bJ9AIPa9ujjblEvDp1JIhrfBUqiuTdvXDZ7XtW8kVsJk1RY=
 =MvWY
 -----END PGP SIGNATURE-----

Merge tag 'wireless-drivers-next-for-davem-2017-11-03' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
wireless-drivers-next patches for 4.15

Mostly fixes this time, but also few new features.

Major changes:

wil6210

* remove ssid debugfs file

rsi

* add WOWLAN support for suspend, hibernate and shutdown states

ath10k

* add support for CCMP-256, GCMP and GCMP-256 ciphers on hardware
  where it's supported (QCA99x0 and QCA4019)
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-04 18:07:50 +09:00
Greg Kroah-Hartman b24413180f License cleanup: add SPDX GPL-2.0 license identifier to files with no license
Many source files in the tree are missing licensing information, which
makes it harder for compliance tools to determine the correct license.

By default all files without license information are under the default
license of the kernel, which is GPL version 2.

Update the files which contain no license information with the 'GPL-2.0'
SPDX license identifier.  The SPDX identifier is a legally binding
shorthand, which can be used instead of the full boiler plate text.

This patch is based on work done by Thomas Gleixner and Kate Stewart and
Philippe Ombredanne.

How this work was done:

Patches were generated and checked against linux-4.14-rc6 for a subset of
the use cases:
 - file had no licensing information it it.
 - file was a */uapi/* one with no licensing information in it,
 - file was a */uapi/* one with existing licensing information,

Further patches will be generated in subsequent months to fix up cases
where non-standard license headers were used, and references to license
had to be inferred by heuristics based on keywords.

The analysis to determine which SPDX License Identifier to be applied to
a file was done in a spreadsheet of side by side results from of the
output of two independent scanners (ScanCode & Windriver) producing SPDX
tag:value files created by Philippe Ombredanne.  Philippe prepared the
base worksheet, and did an initial spot review of a few 1000 files.

The 4.13 kernel was the starting point of the analysis with 60,537 files
assessed.  Kate Stewart did a file by file comparison of the scanner
results in the spreadsheet to determine which SPDX license identifier(s)
to be applied to the file. She confirmed any determination that was not
immediately clear with lawyers working with the Linux Foundation.

Criteria used to select files for SPDX license identifier tagging was:
 - Files considered eligible had to be source code files.
 - Make and config files were included as candidates if they contained >5
   lines of source
 - File already had some variant of a license header in it (even if <5
   lines).

All documentation files were explicitly excluded.

The following heuristics were used to determine which SPDX license
identifiers to apply.

 - when both scanners couldn't find any license traces, file was
   considered to have no license information in it, and the top level
   COPYING file license applied.

   For non */uapi/* files that summary was:

   SPDX license identifier                            # files
   ---------------------------------------------------|-------
   GPL-2.0                                              11139

   and resulted in the first patch in this series.

   If that file was a */uapi/* path one, it was "GPL-2.0 WITH
   Linux-syscall-note" otherwise it was "GPL-2.0".  Results of that was:

   SPDX license identifier                            # files
   ---------------------------------------------------|-------
   GPL-2.0 WITH Linux-syscall-note                        930

   and resulted in the second patch in this series.

 - if a file had some form of licensing information in it, and was one
   of the */uapi/* ones, it was denoted with the Linux-syscall-note if
   any GPL family license was found in the file or had no licensing in
   it (per prior point).  Results summary:

   SPDX license identifier                            # files
   ---------------------------------------------------|------
   GPL-2.0 WITH Linux-syscall-note                       270
   GPL-2.0+ WITH Linux-syscall-note                      169
   ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause)    21
   ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)    17
   LGPL-2.1+ WITH Linux-syscall-note                      15
   GPL-1.0+ WITH Linux-syscall-note                       14
   ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause)    5
   LGPL-2.0+ WITH Linux-syscall-note                       4
   LGPL-2.1 WITH Linux-syscall-note                        3
   ((GPL-2.0 WITH Linux-syscall-note) OR MIT)              3
   ((GPL-2.0 WITH Linux-syscall-note) AND MIT)             1

   and that resulted in the third patch in this series.

 - when the two scanners agreed on the detected license(s), that became
   the concluded license(s).

 - when there was disagreement between the two scanners (one detected a
   license but the other didn't, or they both detected different
   licenses) a manual inspection of the file occurred.

 - In most cases a manual inspection of the information in the file
   resulted in a clear resolution of the license that should apply (and
   which scanner probably needed to revisit its heuristics).

 - When it was not immediately clear, the license identifier was
   confirmed with lawyers working with the Linux Foundation.

 - If there was any question as to the appropriate license identifier,
   the file was flagged for further research and to be revisited later
   in time.

In total, over 70 hours of logged manual review was done on the
spreadsheet to determine the SPDX license identifiers to apply to the
source files by Kate, Philippe, Thomas and, in some cases, confirmation
by lawyers working with the Linux Foundation.

Kate also obtained a third independent scan of the 4.13 code base from
FOSSology, and compared selected files where the other two scanners
disagreed against that SPDX file, to see if there was new insights.  The
Windriver scanner is based on an older version of FOSSology in part, so
they are related.

Thomas did random spot checks in about 500 files from the spreadsheets
for the uapi headers and agreed with SPDX license identifier in the
files he inspected. For the non-uapi files Thomas did random spot checks
in about 15000 files.

In initial set of patches against 4.14-rc6, 3 files were found to have
copy/paste license identifier errors, and have been fixed to reflect the
correct identifier.

Additionally Philippe spent 10 hours this week doing a detailed manual
inspection and review of the 12,461 patched files from the initial patch
version early this week with:
 - a full scancode scan run, collecting the matched texts, detected
   license ids and scores
 - reviewing anything where there was a license detected (about 500+
   files) to ensure that the applied SPDX license was correct
 - reviewing anything where there was no detection but the patch license
   was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied
   SPDX license was correct

This produced a worksheet with 20 files needing minor correction.  This
worksheet was then exported into 3 different .csv files for the
different types of files to be modified.

These .csv files were then reviewed by Greg.  Thomas wrote a script to
parse the csv files and add the proper SPDX tag to the file, in the
format that the file expected.  This script was further refined by Greg
based on the output to detect more types of files automatically and to
distinguish between header and source .c files (which need different
comment types.)  Finally Greg ran the script using the .csv files to
generate the patches.

Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-02 11:10:55 +01:00
Kees Cook 7ac767645a ath: Convert timers to use timer_setup()
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Kalle Valo <kvalo@qca.qualcomm.com>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-10-27 16:54:19 +03:00
Christos Gkekas 9d414949a3 ath9k: debug: Remove redundant check
Variable val is unsigned, so checking whether it is less than zero is
redundant.

Signed-off-by: Christos Gkekas <chris.gekas@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-10-27 16:50:20 +03:00
Miaoqing Pan ee0a47186e ath9k: fix tx99 potential info leak
When the user sets count to zero the string buffer would remain
completely uninitialized which causes the kernel to parse its
own stack data, potentially leading to an info leak. In addition
to that, the string might be not terminated properly when the
user data does not contain a 0-terminator.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Reviewed-by: Christoph Böhmwalder <christoph@boehmwalder.at>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-10-13 14:40:57 +03:00
Colin Ian King eba0f28473 ath9k: make const array reg_hole_list static, reduces object code size
Don't populate the read-only array reg_hole_list on the stack, instead make
it static.  Makes the object code smaller by over 200 bytes:

Before:
   text	   data	    bss	    dec	    hex	filename
  57518	  15248	      0	  72766	  11c3e	debug.o

After:
   text	   data	    bss	    dec	    hex	filename
  57218	  15344	      0	  72562	  11b72	debug.o

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-10-04 12:07:46 +03:00
Ville Syrjälä ba24d63dd3 ath9k: Avoid a potential deadlock
Lockdep warns us that sc_pm_lock and cc_lock can cause a deadlock when
cc_lock is acquired by itself with interrupts enabled. Disable irqs
whenever taking cc_lock to avoid this.

[   19.094524] kworker/u2:0/5 just changed the state of lock:
[   19.094578]  (&(&sc->sc_pm_lock)->rlock){-.-...}, at: [<f836c00e>] ath_isr+0x15e/0x200 [ath9k]
[   19.094674] but this lock took another, HARDIRQ-unsafe lock in the past:
[   19.094731]  (&(&common->cc_lock)->rlock){+.-...}
[   19.094741]

               and interrupts could create inverse lock ordering between them.

[   19.094866]
               other info that might help us debug this:
[   19.094926]  Possible interrupt unsafe locking scenario:

[   19.094985]        CPU0                    CPU1
[   19.095036]        ----                    ----
[   19.095086]   lock(&(&common->cc_lock)->rlock);
[   19.095197]                                local_irq_disable();
[   19.095305]                                lock(&(&sc->sc_pm_lock)->rlock);
[   19.095423]                                lock(&(&common->cc_lock)->rlock);
[   19.095539]   <Interrupt>
[   19.095636]     lock(&(&sc->sc_pm_lock)->rlock);
[   19.095745]
                *** DEADLOCK ***

[   19.095965] 3 locks held by kworker/u2:0/5:
[   19.096067]  #0:  ("%s"wiphy_name(local->hw.wiphy)){.+.+.+}, at: [<c1067f37>] process_one_work+0x127/0x580
[   19.096260]  #1:  ((&local->dynamic_ps_enable_work)){+.+...}, at: [<c1067f37>] process_one_work+0x127/0x580
[   19.096447]  #2:  (&sc->mutex){+.+...}, at: [<f836b8b0>] ath9k_config+0x30/0x1d0 [ath9k]
[   19.096639]
               the shortest dependencies between 2nd lock and 1st lock:
[   19.096813]  -> (&(&common->cc_lock)->rlock){+.-...} ops: 38 {
[   19.096816]     HARDIRQ-ON-W at:
[   19.096816]                       __lock_acquire+0x57e/0x1260
[   19.096816]                       lock_acquire+0xb1/0x1c0
[   19.096816]                       _raw_spin_lock_bh+0x3f/0x50
[   19.096816]                       ath_chanctx_set_channel+0xb6/0x2c0 [ath9k]
[   19.096816]                       ath9k_config+0xa8/0x1d0 [ath9k]
[   19.096816]                       ieee80211_hw_config+0xa8/0x5f0 [mac80211]
[   19.096816]                       ieee80211_do_open+0x67a/0x920 [mac80211]
[   19.096816]                       ieee80211_open+0x41/0x50 [mac80211]
[   19.096816]                       __dev_open+0xab/0x140
[   19.096816]                       __dev_change_flags+0x89/0x150
[   19.096816]                       dev_change_flags+0x28/0x60
[   19.096816]                       do_setlink+0x290/0x890
[   19.096816]                       rtnl_newlink+0x7cf/0x8e0
[   19.096816]                       rtnetlink_rcv_msg+0xbf/0x1f0
[   19.096816]                       netlink_rcv_skb+0xb9/0xe0
[   19.096816]                       rtnetlink_rcv+0x1e/0x30
[   19.096816]                       netlink_unicast+0x13a/0x2c0
[   19.096816]                       netlink_sendmsg+0x290/0x380
[   19.096816]                       ___sys_sendmsg+0x1e2/0x280
[   19.096816]                       __sys_sendmsg+0x3f/0x80
[   19.096816]                       SyS_socketcall+0x58c/0x6b0
[   19.096816]                       do_fast_syscall_32+0x96/0x1d0
[   19.096816]                       entry_SYSENTER_32+0x4c/0x7b
[   19.096816]     IN-SOFTIRQ-W at:
[   19.096816]                       __lock_acquire+0x55a/0x1260
[   19.096816]                       lock_acquire+0xb1/0x1c0
[   19.096816]                       _raw_spin_lock+0x3c/0x50
[   19.096816]                       ath_ps_full_sleep+0x24/0x70 [ath9k]
[   19.096816]                       call_timer_fn+0xa4/0x300
[   19.096816]                       run_timer_softirq+0x1b1/0x560
[   19.096816]                       __do_softirq+0xb0/0x430
[   19.096816]                       do_softirq_own_stack+0x33/0x40
[   19.096816]                       irq_exit+0xad/0xc0
[   19.096816]                       smp_apic_timer_interrupt+0x31/0x40
[   19.096816]                       apic_timer_interrupt+0x37/0x3c
[   19.096816]                       wp_page_copy+0xb8/0x580
[   19.096816]                       do_wp_page+0x64/0x420
[   19.096816]                       handle_mm_fault+0x430/0x990
[   19.096816]                       __do_page_fault+0x18b/0x430
[   19.096816]                       do_page_fault+0xb/0x10
[   19.096816]                       common_exception+0x62/0x6a
[   19.096816]     INITIAL USE at:
[   19.096816]                      __lock_acquire+0x204/0x1260
[   19.096816]                      lock_acquire+0xb1/0x1c0
[   19.096816]                      _raw_spin_lock_bh+0x3f/0x50
[   19.096816]                      ath_chanctx_set_channel+0xb6/0x2c0 [ath9k]
[   19.096816]                      ath9k_config+0xa8/0x1d0 [ath9k]
[   19.096816]                      ieee80211_hw_config+0xa8/0x5f0 [mac80211]
[   19.096816]                      ieee80211_do_open+0x67a/0x920 [mac80211]
[   19.096816]                      ieee80211_open+0x41/0x50 [mac80211]
[   19.096816]                      __dev_open+0xab/0x140
[   19.096816]                      __dev_change_flags+0x89/0x150
[   19.096816]                      dev_change_flags+0x28/0x60
[   19.096816]                      do_setlink+0x290/0x890
[   19.096816]                      rtnl_newlink+0x7cf/0x8e0
[   19.096816]                      rtnetlink_rcv_msg+0xbf/0x1f0
[   19.096816]                      netlink_rcv_skb+0xb9/0xe0
[   19.096816]                      rtnetlink_rcv+0x1e/0x30
[   19.096816]                      netlink_unicast+0x13a/0x2c0
[   19.096816]                      netlink_sendmsg+0x290/0x380
[   19.096816]                      ___sys_sendmsg+0x1e2/0x280
[   19.096816]                      __sys_sendmsg+0x3f/0x80
[   19.096816]                      SyS_socketcall+0x58c/0x6b0
[   19.096816]                      do_fast_syscall_32+0x96/0x1d0
[   19.096816]                      entry_SYSENTER_32+0x4c/0x7b
[   19.096816]   }
[   19.096816]   ... key      at: [<f837b694>] __key.61991+0x0/0xffffc96c [ath9k]
[   19.096816]   ... acquired at:
[   19.096816]    lock_acquire+0xb1/0x1c0
[   19.096816]    _raw_spin_lock+0x3c/0x50
[   19.096816]    ath9k_ps_wakeup+0x85/0xe0 [ath9k]
[   19.096816]    ath9k_bss_info_changed+0x2a/0x1b0 [ath9k]
[   19.096816]    ieee80211_bss_info_change_notify+0xf3/0x360 [mac80211]
[   19.096816]    ieee80211_recalc_txpower+0x33/0x40 [mac80211]
[   19.096816]    ieee80211_set_tx_power+0x45/0x1d0 [mac80211]
[   19.096816]    cfg80211_wext_siwtxpower+0xd3/0x350 [cfg80211]
[   19.096816]    ioctl_standard_call+0x4e/0x400
[   19.096816]    wext_handle_ioctl+0xf4/0x190
[   19.096816]    dev_ioctl+0xb7/0x630
[   19.096816]    sock_ioctl+0x13e/0x2d0
[   19.096816]    do_vfs_ioctl+0x84/0x750
[   19.096816]    SyS_ioctl+0x34/0x60
[   19.096816]    do_fast_syscall_32+0x96/0x1d0
[   19.096816]    entry_SYSENTER_32+0x4c/0x7b

[   19.096816] -> (&(&sc->sc_pm_lock)->rlock){-.-...} ops: 597 {
[   19.096816]    IN-HARDIRQ-W at:
[   19.096816]                     __lock_acquire+0x6ae/0x1260
[   19.096816]                     lock_acquire+0xb1/0x1c0
[   19.096816]                     _raw_spin_lock_irqsave+0x45/0x60
[   19.096816]                     ath_isr+0x15e/0x200 [ath9k]
[   19.096816]                     __handle_irq_event_percpu+0x44/0x340
[   19.096816]                     handle_irq_event_percpu+0x1d/0x50
[   19.096816]                     handle_irq_event+0x32/0x60
[   19.096816]                     handle_level_irq+0x81/0x100
[   19.096816]                     handle_irq+0x9c/0xd0
[   19.096816]                     do_IRQ+0x5c/0x120
[   19.096816]                     common_interrupt+0x36/0x3c
[   19.096816]                     _raw_spin_unlock_irqrestore+0x57/0x70
[   19.096816]                     ath9k_config+0x16a/0x1d0 [ath9k]
[   19.096816]                     ieee80211_hw_config+0xa8/0x5f0 [mac80211]
[   19.096816]                     ieee80211_dynamic_ps_enable_work+0x1c3/0x680 [mac80211]
[   19.096816]                     process_one_work+0x1d1/0x580
[   19.096816]                     worker_thread+0x31/0x380
[   19.096816]                     kthread+0xd9/0x110
[   19.096816]                     ret_from_fork+0x19/0x24
[   19.096816]    IN-SOFTIRQ-W at:
[   19.096816]                     __lock_acquire+0x55a/0x1260
[   19.096816]                     lock_acquire+0xb1/0x1c0
[   19.096816]                     _raw_spin_lock_irqsave+0x45/0x60
[   19.096816]                     ath9k_ps_wakeup+0x24/0xe0 [ath9k]
[   19.096816]                     ath9k_tasklet+0x42/0x260 [ath9k]
[   19.096816]                     tasklet_action+0x196/0x1e0
[   19.096816]                     __do_softirq+0xb0/0x430
[   19.096816]                     do_softirq_own_stack+0x33/0x40
[   19.096816]                     irq_exit+0xad/0xc0
[   19.096816]                     do_IRQ+0x65/0x120
[   19.096816]                     common_interrupt+0x36/0x3c
[   19.096816]                     get_page_from_freelist+0x20a/0x970
[   19.096816]                     __alloc_pages_nodemask+0xca/0xed0
[   19.096816]                     __get_free_pages+0x14/0x30
[   19.096816]                     pgd_alloc+0x1d/0x160
[   19.096816]                     mm_init.isra.47+0x13a/0x1b0
[   19.096816]                     copy_process.part.54+0xb55/0x1700
[   19.096816]                     _do_fork+0xd4/0x6a0
[   19.096816]                     SyS_clone+0x27/0x30
[   19.096816]                     do_fast_syscall_32+0x96/0x1d0
[   19.096816]                     entry_SYSENTER_32+0x4c/0x7b
[   19.096816]    INITIAL USE at:
[   19.096816]                    __lock_acquire+0x204/0x1260
[   19.096816]                    lock_acquire+0xb1/0x1c0
[   19.096816]                    _raw_spin_lock_irqsave+0x45/0x60
[   19.096816]                    ath9k_ps_wakeup+0x24/0xe0 [ath9k]
[   19.096816]                    ath9k_start+0x29/0x1f0 [ath9k]
[   19.096816]                    drv_start+0x71/0x270 [mac80211]
[   19.096816]                    ieee80211_do_open+0x31f/0x920 [mac80211]
[   19.096816]                    ieee80211_open+0x41/0x50 [mac80211]
[   19.096816]                    __dev_open+0xab/0x140
[   19.096816]                    __dev_change_flags+0x89/0x150
[   19.096816]                    dev_change_flags+0x28/0x60
[   19.096816]                    do_setlink+0x290/0x890
[   19.096816]                    rtnl_newlink+0x7cf/0x8e0
[   19.096816]                    rtnetlink_rcv_msg+0xbf/0x1f0
[   19.096816]                    netlink_rcv_skb+0xb9/0xe0
[   19.096816]                    rtnetlink_rcv+0x1e/0x30
[   19.096816]                    netlink_unicast+0x13a/0x2c0
[   19.096816]                    netlink_sendmsg+0x290/0x380
[   19.096816]                    ___sys_sendmsg+0x1e2/0x280
[   19.096816]                    __sys_sendmsg+0x3f/0x80
[   19.096816]                    SyS_socketcall+0x58c/0x6b0
[   19.096816]                    do_fast_syscall_32+0x96/0x1d0
[   19.096816]                    entry_SYSENTER_32+0x4c/0x7b
[   19.096816]  }
[   19.096816]  ... key      at: [<f837b67c>] __key.61994+0x0/0xffffc984 [ath9k]
[   19.096816]  ... acquired at:
[   19.096816]    check_usage_forwards+0x118/0x120
[   19.096816]    mark_lock+0x2e4/0x590
[   19.096816]    __lock_acquire+0x6ae/0x1260
[   19.096816]    lock_acquire+0xb1/0x1c0
[   19.096816]    _raw_spin_lock_irqsave+0x45/0x60
[   19.096816]    ath_isr+0x15e/0x200 [ath9k]
[   19.096816]    __handle_irq_event_percpu+0x44/0x340
[   19.096816]    handle_irq_event_percpu+0x1d/0x50
[   19.096816]    handle_irq_event+0x32/0x60
[   19.096816]    handle_level_irq+0x81/0x100
[   19.096816]    handle_irq+0x9c/0xd0
[   19.096816]    do_IRQ+0x5c/0x120
[   19.096816]    common_interrupt+0x36/0x3c
[   19.096816]    _raw_spin_unlock_irqrestore+0x57/0x70
[   19.096816]    ath9k_config+0x16a/0x1d0 [ath9k]
[   19.096816]    ieee80211_hw_config+0xa8/0x5f0 [mac80211]
[   19.096816]    ieee80211_dynamic_ps_enable_work+0x1c3/0x680 [mac80211]
[   19.096816]    process_one_work+0x1d1/0x580
[   19.096816]    worker_thread+0x31/0x380
[   19.096816]    kthread+0xd9/0x110
[   19.096816]    ret_from_fork+0x19/0x24

[   19.096816]
               stack backtrace:
[   19.096816] CPU: 0 PID: 5 Comm: kworker/u2:0 Not tainted 4.13.0-mgm-ovl+ #51
[   19.096816] Hardware name: FUJITSU SIEMENS LIFEBOOK S6120/FJNB16C, BIOS Version 1.26  05/10/2004
[   19.096816] Workqueue: phy0 ieee80211_dynamic_ps_enable_work [mac80211]
[   19.096816] Call Trace:
[   19.096816]  <IRQ>
[   19.096816]  dump_stack+0x16/0x19
[   19.096816]  print_irq_inversion_bug.part.37+0x16c/0x179
[   19.096816]  check_usage_forwards+0x118/0x120
[   19.096816]  ? ret_from_fork+0x19/0x24
[   19.096816]  ? print_shortest_lock_dependencies+0x1a0/0x1a0
[   19.096816]  mark_lock+0x2e4/0x590
[   19.096816]  ? print_shortest_lock_dependencies+0x1a0/0x1a0
[   19.096816]  __lock_acquire+0x6ae/0x1260
[   19.096816]  lock_acquire+0xb1/0x1c0
[   19.096816]  ? ath_isr+0x15e/0x200 [ath9k]
[   19.096816]  _raw_spin_lock_irqsave+0x45/0x60
[   19.096816]  ? ath_isr+0x15e/0x200 [ath9k]
[   19.096816]  ath_isr+0x15e/0x200 [ath9k]
[   19.096816]  __handle_irq_event_percpu+0x44/0x340
[   19.096816]  handle_irq_event_percpu+0x1d/0x50
[   19.096816]  handle_irq_event+0x32/0x60
[   19.096816]  ? handle_nested_irq+0x100/0x100
[   19.096816]  handle_level_irq+0x81/0x100
[   19.096816]  handle_irq+0x9c/0xd0
[   19.096816]  </IRQ>
[   19.096816]  do_IRQ+0x5c/0x120
[   19.096816]  common_interrupt+0x36/0x3c
[   19.096816] EIP: _raw_spin_unlock_irqrestore+0x57/0x70
[   19.096816] EFLAGS: 00000286 CPU: 0
[   19.096816] EAX: f60a3600 EBX: 00000286 ECX: 00000006 EDX: 00000001
[   19.096816] ESI: f46c9e68 EDI: f46c8620 EBP: f60b5e8c ESP: f60b5e84
[   19.096816]  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
[   19.096816]  ath9k_config+0x16a/0x1d0 [ath9k]
[   19.096816]  ieee80211_hw_config+0xa8/0x5f0 [mac80211]
[   19.096816]  ? ieee80211_hw_config+0x1db/0x5f0 [mac80211]
[   19.096816]  ieee80211_dynamic_ps_enable_work+0x1c3/0x680 [mac80211]
[   19.096816]  ? process_one_work+0x127/0x580
[   19.096816]  ? process_one_work+0x127/0x580
[   19.096816]  process_one_work+0x1d1/0x580
[   19.096816]  ? process_one_work+0x127/0x580
[   19.096816]  worker_thread+0x31/0x380
[   19.096816]  kthread+0xd9/0x110
[   19.096816]  ? process_one_work+0x580/0x580
[   19.096816]  ? kthread_create_on_node+0x30/0x30
[   19.096816]  ret_from_fork+0x19/0x24

Cc: QCA ath9k Development <ath9k-devel@qca.qualcomm.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: netdev@vger.kernel.org
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-09-25 10:17:42 +03:00
Thomas Meyer 896cbefadf ath9k: Use ARRAY_SIZE macro
Use ARRAY_SIZE macro, rather than explicitly coding some variant of it
yourself.
Found with: find -type f -name "*.c" -o -name "*.h" | xargs perl -p -i -e
's/\bsizeof\s*\(\s*(\w+)\s*\)\s*\ /\s*sizeof\s*\(\s*\1\s*\[\s*0\s*\]\s*\)
/ARRAY_SIZE(\1)/g' and manual check/verification.

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-09-25 10:14:41 +03:00
Himanshu Jha 50c8cd44ed ath9k: remove cast to void pointer
casting to void pointer from any pointer type and vice-versa is done
implicitly and therefore casting is not needed in such a case.

Done using Coccinellle.
Semantic Patch used :

@r@
expression x;
void* e;
type T;
identifier f;
@@

(
  *((T *)e)
|
  ((T *)x)[...]
|
  ((T *)x)->f
|
- (T *)
  e
)


Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-09-25 10:13:58 +03:00
Arvind Yadav 76b07b30c4 ath9k: constify usb_device_id
usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-const structs as const.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-11 16:59:07 +03:00
Bhumika Goyal 3588e1110e ath9k: make ath_ps_ops structures as const
ath_ps_ops structures are only stored as a reference in the ps_ops
field of a ath_common structure. This field is of type const, so make
the structures as const.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-08 14:09:15 +03:00
Rosen Penev 129e12a9eb ath9k: Add Dell Wireless 1802 with wowlan capability
Add the Dell Wireless 1802 card as an AR9462 in the ath9k pci list.
Note that the wowlan feature is supported and has been tested
successfully.

Signed-off by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-03 14:39:31 +03:00
Christoph Fritz f085c10547 ath9k: fix debugfs file permission
This patch fixes a trivial debugfs file permission issue. Debugfs
file ack_to has no write function, so S_IWUSR gets purged.

Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-03 14:38:36 +03:00
Gustavo A. R. Silva 6788a3832c ath9k: remove useless variable assignment in ath_mci_intr()
Value assigned to variable offset at line 551 is overwritten at line 562,
before it can be used. This makes such variable assignment useless.

Addresses-Coverity-ID: 1226941
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-06-28 19:56:36 +03:00
Miaoqing Pan f23cdfb3fe ath9k: Use mutex_lock to avoid potential race in start/stop rng
Move ath9k_rng_stop/ath9k_rng_start pair into critical section,
use mutex_lock to void potential race accessing.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-06-28 19:54:43 +03:00
Miaoqing Pan 473becac4b ath9k: avoid potential freezing during random generator read
In the worst case, ath9k_rng_stop() may take 10s to stop rng kthread.
The time is too long for users, use wait_event_interruptible_timeout()
instead of msleep_interruptible(), wakup immediately once
kthread_should_stop() is true.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-06-28 19:54:38 +03:00
Miaoqing Pan 07246c1158 ath9k: fix an invalid pointer dereference in ath9k_rng_stop()
The bug was triggered when do suspend/resuming continuously
on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel
4.12.0-041200rc4-generic. But can't reproduce on DELL
E5440 + AR9300 PCIE chips.

The warning is caused by accessing invalid pointer sc->rng_task.
sc->rng_task is not be cleared after kthread_stop(sc->rng_task)
be called in ath9k_rng_stop(). Because the kthread is stopped
before ath9k_rng_kthread() be scheduled.

So set sc->rng_task to null after kthread_stop(sc->rng_task) to
resolve this issue.

WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100
CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031
Hardware name: Dell Inc.          Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013
task: ffff950170fdda00 task.stack: ffffa22c01538000
RIP: 0010:kthread_stop+0xf1/0x100
RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246
RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000
RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680
RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000
R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680
R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018
FS:  00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0
Call Trace:
  ath9k_rng_stop+0x1a/0x20 [ath9k]
  ath9k_stop+0x3b/0x1d0 [ath9k]
  drv_stop+0x33/0xf0 [mac80211]
  ieee80211_stop_device+0x43/0x50 [mac80211]
  ieee80211_do_stop+0x4f2/0x810 [mac80211]

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043
Reported-by: Giulio Genovese <giulio.genovese@gmail.com>
Tested-by: Giulio Genovese <giulio.genovese@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-06-28 19:54:33 +03:00
Miaoqing Pan bde717ab47 ath9k: fix tx99 bus error
The hard coded register 0x9864 and 0x9924 are invalid
for ar9300 chips.

Cc: <stable@vger.kernel.org>
Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-06-28 19:52:26 +03:00
Miaoqing Pan cf8ce1ea61 ath9k: fix tx99 use after free
One scenario that could lead to UAF is two threads writing
simultaneously to the "tx99" debug file. One of them would
set the "start" value to true and follow to ath9k_tx99_init().
Inside the function it would set the sc->tx99_state to true
after allocating sc->tx99skb. Then, the other thread would
execute write_file_tx99() and call ath9k_tx99_deinit().
sc->tx99_state would be freed. After that, the first thread
would continue inside ath9k_tx99_init() and call
r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
that would make use of the freed sc->tx99_skb memory.

Cc: <stable@vger.kernel.org>
Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-06-28 19:52:21 +03:00