mac80211: update to version 4.19.23-1

This updates mac80211 to backports version 4.19.23-1 which includes all
the stable fixes from kernel 4.19.23.
The removed patches are included in this version.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

5 files changed, 20 insertions, 237 deletions

diff --git a/package/kernel/mac80211/patches/brcm/307-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch b/package/kernel/mac80211/patches/brcm/307-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
deleted file mode 100644
index 154664c854..0000000000
--- a/package/kernel/mac80211/patches/brcm/307-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 3401d42c7ea2d064d15c66698ff8eb96553179ce Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Fri, 26 Oct 2018 12:50:39 +0200
-Subject: [PATCH] brcmutil: really fix decoding channel info for 160 MHz
- bandwidth
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Previous commit /adding/ support for 160 MHz chanspecs was incomplete.
-It didn't set bandwidth info and didn't extract control channel info. As
-the result it was also using uninitialized "sb" var.
-
-This change has been tested for two chanspecs found to be reported by
-some devices/firmwares:
-1) 60/160 (0xee32)
-   Before: chnum:50 control_ch_num:36
-    After: chnum:50 control_ch_num:60
-2) 120/160 (0xed72)
-   Before: chnum:114 control_ch_num:100
-    After: chnum:114 control_ch_num:120
-
-Fixes: 330994e8e8ec ("brcmfmac: fix for proper support of 160MHz bandwidth")
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
-@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct
- 		}
- 		break;
- 	case BRCMU_CHSPEC_D11AC_BW_160:
-+		ch->bw = BRCMU_CHAN_BW_160;
-+		ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
-+					 BRCMU_CHSPEC_D11AC_SB_SHIFT);
- 		switch (ch->sb) {
- 		case BRCMU_CHAN_SB_LLL:
- 			ch->control_ch_num -= CH_70MHZ_APART;
diff --git a/package/kernel/mac80211/patches/brcm/327-v5.0-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch b/package/kernel/mac80211/patches/brcm/327-v5.0-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
deleted file mode 100644
index 0ed148188b..0000000000
--- a/package/kernel/mac80211/patches/brcm/327-v5.0-brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From b72c51a58e6d63ef673ac96b8ab5bc98799c5f7b Mon Sep 17 00:00:00 2001
-From: Lyude Paul <lyude@redhat.com>
-Date: Sat, 24 Nov 2018 17:57:05 -0500
-Subject: [PATCH] brcmfmac: Fix out of bounds memory access during fw load
-
-I ended up tracking down some rather nasty issues with f2fs (and other
-filesystem modules) constantly crashing on my kernel down to a
-combination of out of bounds memory accesses, one of which was coming
-from brcmfmac during module load:
-
-[   30.891382] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2
-[   30.894437] ==================================================================
-[   30.901581] BUG: KASAN: global-out-of-bounds in brcmf_fw_alloc_request+0x42c/0x480 [brcmfmac]
-[   30.909935] Read of size 1 at addr ffff2000024865df by task kworker/6:2/387
-[   30.916805]
-[   30.918261] CPU: 6 PID: 387 Comm: kworker/6:2 Tainted: G           O      4.20.0-rc3Lyude-Test+ #19
-[   30.927251] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018
-[   30.935964] Workqueue: events brcmf_driver_register [brcmfmac]
-[   30.941641] Call trace:
-[   30.944058]  dump_backtrace+0x0/0x3e8
-[   30.947676]  show_stack+0x14/0x20
-[   30.950968]  dump_stack+0x130/0x1c4
-[   30.954406]  print_address_description+0x60/0x25c
-[   30.959066]  kasan_report+0x1b4/0x368
-[   30.962683]  __asan_report_load1_noabort+0x18/0x20
-[   30.967547]  brcmf_fw_alloc_request+0x42c/0x480 [brcmfmac]
-[   30.967639]  brcmf_sdio_probe+0x163c/0x2050 [brcmfmac]
-[   30.978035]  brcmf_ops_sdio_probe+0x598/0xa08 [brcmfmac]
-[   30.983254]  sdio_bus_probe+0x190/0x398
-[   30.983270]  really_probe+0x2a0/0xa70
-[   30.983296]  driver_probe_device+0x1b4/0x2d8
-[   30.994901]  __driver_attach+0x200/0x280
-[   30.994914]  bus_for_each_dev+0x10c/0x1a8
-[   30.994925]  driver_attach+0x38/0x50
-[   30.994935]  bus_add_driver+0x330/0x608
-[   30.994953]  driver_register+0x140/0x388
-[   31.013965]  sdio_register_driver+0x74/0xa0
-[   31.014076]  brcmf_sdio_register+0x14/0x60 [brcmfmac]
-[   31.023177]  brcmf_driver_register+0xc/0x18 [brcmfmac]
-[   31.023209]  process_one_work+0x654/0x1080
-[   31.032266]  worker_thread+0x4f0/0x1308
-[   31.032286]  kthread+0x2a8/0x320
-[   31.039254]  ret_from_fork+0x10/0x1c
-[   31.039269]
-[   31.044226] The buggy address belongs to the variable:
-[   31.044351]  brcmf_firmware_path+0x11f/0xfffffffffffd3b40 [brcmfmac]
-[   31.055601]
-[   31.057031] Memory state around the buggy address:
-[   31.061800]  ffff200002486480: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
-[   31.068983]  ffff200002486500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-[   31.068993] >ffff200002486580: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
-[   31.068999]                                                     ^
-[   31.069017]  ffff200002486600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-[   31.096521]  ffff200002486680: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
-[   31.096528] ==================================================================
-[   31.096533] Disabling lock debugging due to kernel taint
-
-It appears that when trying to determine the length of the string in the
-alternate firmware path, we make the mistake of not handling the case
-where the firmware path is empty correctly. Since strlen(mp_path) can
-return 0, we'll end up accessing mp_path[-1] when the firmware_path
-isn't provided through the module arguments.
-
-So, fix this by just setting the end char to '\0' by default, and only
-changing it if we have a non-zero length. Additionally, use strnlen()
-with BRCMF_FW_ALTPATH_LEN instead of strlen() just to be extra safe.
-
-Fixes: 2baa3aaee27f ("brcmfmac: introduce brcmf_fw_alloc_request() function")
-Cc: Hante Meuleman <hante.meuleman@broadcom.com>
-Cc: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
-Cc: Franky Lin <franky.lin@broadcom.com>
-Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
-Cc: Kalle Valo <kvalo@codeaurora.org>
-Cc: Arend Van Spriel <arend.vanspriel@broadcom.com>
-Cc: Himanshu Jha <himanshujha199640@gmail.com>
-Cc: Dan Haab <dhaab@luxul.com>
-Cc: Jia-Shyr Chuang <saint.chuang@cypress.com>
-Cc: Ian Molton <ian@mnementh.co.uk>
-Cc: <stable@vger.kernel.org> # v4.17+
-Signed-off-by: Lyude Paul <lyude@redhat.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c   | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-@@ -708,8 +708,9 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
- 	struct brcmf_fw_request *fwreq;
- 	char chipname[12];
- 	const char *mp_path;
-+	size_t mp_path_len;
- 	u32 i, j;
--	char end;
-+	char end = '\0';
- 	size_t reqsz;
- 
- 	for (i = 0; i < table_size; i++) {
-@@ -734,7 +735,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chi
- 		   mapping_table[i].fw_base, chipname);
- 
- 	mp_path = brcmf_mp_global.firmware_path;
--	end = mp_path[strlen(mp_path) - 1];
-+	mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
-+	if (mp_path_len)
-+		end = mp_path[mp_path_len - 1];
-+
- 	fwreq->n_items = n_fwnames;
- 
- 	for (j = 0; j < n_fwnames; j++) {
diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch
index c73ee93a8d..9602792d4f 100644
--- a/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch
+++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch
@@ -17,7 +17,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6631,6 +6631,12 @@ static s32 brcmf_config_dongle(struct br
+@@ -6638,6 +6638,12 @@ static s32 brcmf_config_dongle(struct br
  
  	brcmf_configure_arp_nd_offload(ifp, true);
  
diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch
index f7e09ecaab..d44c8737ad 100644
--- a/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch
+++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch
@@ -77,6 +77,19 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 -	entry->transit_count--;
 -	if (entry->suppressed && entry->suppr_transit_count)
 -		entry->suppr_transit_count--;
+-
+-	brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name, flags,
+-		  skcb->htod, seq);
+-
+-	/* pick up the implicit credit from this packet */
+-	fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
+-	if ((fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT) ||
+-	    (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) ||
+-	    (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)) {
+-		brcmf_fws_return_credits(fws, fifo, 1);
+-		brcmf_fws_schedule_deq(fws);
+-	}
+-	brcmf_fws_macdesc_return_req_credit(skb);
 +		skcb = brcmf_skbcb(skb);
 +		entry = skcb->mac;
 +		if (WARN_ON(!entry)) {
@@ -87,20 +100,13 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +		if (entry->suppressed && entry->suppr_transit_count)
 +			entry->suppr_transit_count--;
  
--	brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name, flags,
--		  skcb->htod, seq);
+-	ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
+-	if (ret) {
+-		brcmu_pkt_buf_free_skb(skb);
+-		return -EINVAL;
 +		brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name,
 +			  flags, skcb->htod, seq);
- 
--	/* pick up the implicit credit from this packet */
--	fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
--	if ((fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT) ||
--	    (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) ||
--	    (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)) {
--		brcmf_fws_return_credits(fws, fifo, 1);
--		brcmf_fws_schedule_deq(fws);
--	}
--	brcmf_fws_macdesc_return_req_credit(skb);
++
 +		/* pick up the implicit credit from this packet */
 +		fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
 +		if (fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT ||
@@ -110,11 +116,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 +			brcmf_fws_schedule_deq(fws);
 +		}
 +		brcmf_fws_macdesc_return_req_credit(skb);
- 
--	ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
--	if (ret) {
--		brcmu_pkt_buf_free_skb(skb);
--		return -EINVAL;
++
 +		ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
 +		if (ret) {
 +			brcmu_pkt_buf_free_skb(skb);
diff --git a/package/kernel/mac80211/patches/brcm/331-v5.0-0001-brcmfmac-fix-roamoff-1-modparam.patch b/package/kernel/mac80211/patches/brcm/331-v5.0-0001-brcmfmac-fix-roamoff-1-modparam.patch
deleted file mode 100644
index 4ddc903418..0000000000
--- a/package/kernel/mac80211/patches/brcm/331-v5.0-0001-brcmfmac-fix-roamoff-1-modparam.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 8c892df41500469729e0d662816300196e4f463d Mon Sep 17 00:00:00 2001
-From: Stijn Tintel <stijn@linux-ipv6.be>
-Date: Tue, 4 Dec 2018 20:29:05 +0200
-Subject: [PATCH] brcmfmac: fix roamoff=1 modparam
-
-When the update_connect_param callback is set, nl80211 expects the flag
-WIPHY_FLAG_SUPPORTS_FW_ROAM to be set as well. However, this flag is
-only set when modparam roamoff=0, while the callback is set
-unconditionally. Since commit 7f9a3e150ec7 this causes a warning in
-wiphy_register, which breaks brcmfmac.
-
-Disable the update_connect_param callback when roamoff=0 to fix this.
-
-Fixes: 7f9a3e150ec7 ("nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS")
-Cc: Stable <stable@vger.kernel.org> # 4.19+
-Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
-Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c   | 11 +++++++++--
- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.h   |  2 +-
- .../net/wireless/broadcom/brcm80211/brcmfmac/core.c   |  2 +-
- 3 files changed, 11 insertions(+), 4 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5188,10 +5188,17 @@ static struct cfg80211_ops brcmf_cfg8021
- 	.del_pmk = brcmf_cfg80211_del_pmk,
- };
- 
--struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
-+struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
- {
--	return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
-+	struct cfg80211_ops *ops;
-+
-+	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
- 		       GFP_KERNEL);
-+
-+	if (ops && settings->roamoff)
-+		ops->update_connect_params = NULL;
-+
-+	return ops;
- }
- 
- struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
-@@ -404,7 +404,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
- void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
- s32 brcmf_cfg80211_up(struct net_device *ndev);
- s32 brcmf_cfg80211_down(struct net_device *ndev);
--struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
-+struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings);
- enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
- 
- struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1151,7 +1151,7 @@ int brcmf_attach(struct device *dev, str
- 
- 	brcmf_dbg(TRACE, "Enter\n");
- 
--	ops = brcmf_cfg80211_get_ops();
-+	ops = brcmf_cfg80211_get_ops(settings);
- 	if (!ops)
- 		return -ENOMEM;
-