From 3531a96df77badd489681766e29c919b6e017b2d Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sun, 5 Dec 2021 16:36:05 +0100 Subject: mac80211: Update to version 5.15.8 The following patches were backported from upstream before and are not needed any more: package/kernel/mac80211/patches/ath10k/081-ath10k-fix-module-load-regression-with-iram-recovery-feature.patch package/kernel/mac80211/patches/ath10k/980-ath10k-fix-max-antenna-gain-unit.patch package/kernel/mac80211/patches/build/010-headers-Add-devm_platform_get_and_ioremap_resource.patch package/kernel/mac80211/patches/subsys/300-mac80211-drop-check-for-DONT_REORDER-in-__ieee80211_.patch package/kernel/mac80211/patches/subsys/307-mac80211-do-not-access-the-IV-when-it-was-stripped.patch package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch Signed-off-by: Hauke Mehrtens --- .../subsys/110-mac80211_keep_keys_on_stop_ap.patch | 2 +- .../mac80211/patches/subsys/210-ap_scan.patch | 2 +- ...op-check-for-DONT_REORDER-in-__ieee80211_.patch | 37 ---------------- ...fix-rate-control-for-retransmitted-frames.patch | 2 +- ...et-up-the-fwd_skb-dev-for-mesh-forwarding.patch | 2 +- ...do-not-access-the-IV-when-it-was-stripped.patch | 26 ------------ ...8-mac80211-fix-radiotap-header-generation.patch | 49 ---------------------- .../patches/subsys/400-allow-ibss-mixed.patch | 2 +- .../500-mac80211_configure_antenna_gain.patch | 6 +-- 9 files changed, 8 insertions(+), 120 deletions(-) delete mode 100644 package/kernel/mac80211/patches/subsys/300-mac80211-drop-check-for-DONT_REORDER-in-__ieee80211_.patch delete mode 100644 package/kernel/mac80211/patches/subsys/307-mac80211-do-not-access-the-IV-when-it-was-stripped.patch delete mode 100644 package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch (limited to 'package/kernel/mac80211/patches/subsys') diff --git a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch index 02b2947ebf..638da14346 100644 --- a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch +++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch @@ -2,7 +2,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnects --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c -@@ -1314,7 +1314,6 @@ static int ieee80211_stop_ap(struct wiph +@@ -1316,7 +1316,6 @@ static int ieee80211_stop_ap(struct wiph sdata->vif.bss_conf.ftmr_params = NULL; __sta_info_flush(sdata, true); diff --git a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch index 5d1823e5c6..0c06829ce4 100644 --- a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch +++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch @@ -1,6 +1,6 @@ --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c -@@ -2495,7 +2495,7 @@ static int ieee80211_scan(struct wiphy * +@@ -2497,7 +2497,7 @@ static int ieee80211_scan(struct wiphy * * the frames sent while scanning on other channel will be * lost) */ diff --git a/package/kernel/mac80211/patches/subsys/300-mac80211-drop-check-for-DONT_REORDER-in-__ieee80211_.patch b/package/kernel/mac80211/patches/subsys/300-mac80211-drop-check-for-DONT_REORDER-in-__ieee80211_.patch deleted file mode 100644 index b55da2b1aa..0000000000 --- a/package/kernel/mac80211/patches/subsys/300-mac80211-drop-check-for-DONT_REORDER-in-__ieee80211_.patch +++ /dev/null @@ -1,37 +0,0 @@ -From: Felix Fietkau -Date: Wed, 10 Nov 2021 22:17:13 +0100 -Subject: [PATCH] mac80211: drop check for DONT_REORDER in - __ieee80211_select_queue - -When __ieee80211_select_queue is called, skb->cb has not been cleared yet, -which means that info->control.flags can contain garbage. -In some cases this leads to IEEE80211_TX_CTRL_DONT_REORDER being set, causing -packets marked for other queues to randomly end up in BE instead. - -This flag only needs to be checked in ieee80211_select_queue_80211, since -the radiotap parser is the only piece of code that sets it - -Fixes: 66d06c84730c ("mac80211: adhere to Tx control flag that prevents frame reordering") -Cc: stable@vger.kernel.org -Signed-off-by: Felix Fietkau ---- - ---- a/net/mac80211/wme.c -+++ b/net/mac80211/wme.c -@@ -143,7 +143,6 @@ u16 ieee80211_select_queue_80211(struct - u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata, - struct sta_info *sta, struct sk_buff *skb) - { -- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); - struct mac80211_qos_map *qos_map; - bool qos; - -@@ -156,7 +155,7 @@ u16 __ieee80211_select_queue(struct ieee - else - qos = false; - -- if (!qos || (info->control.flags & IEEE80211_TX_CTRL_DONT_REORDER)) { -+ if (!qos) { - skb->priority = 0; /* required for correct WPA/11i MIC */ - return IEEE80211_AC_BE; - } diff --git a/package/kernel/mac80211/patches/subsys/301-mac80211-fix-rate-control-for-retransmitted-frames.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-fix-rate-control-for-retransmitted-frames.patch index 42f7d6bfe7..98dfe88cbd 100644 --- a/package/kernel/mac80211/patches/subsys/301-mac80211-fix-rate-control-for-retransmitted-frames.patch +++ b/package/kernel/mac80211/patches/subsys/301-mac80211-fix-rate-control-for-retransmitted-frames.patch @@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -1825,15 +1825,15 @@ static int invoke_tx_handlers_late(struc +@@ -1821,15 +1821,15 @@ static int invoke_tx_handlers_late(struc struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); ieee80211_tx_result res = TX_CONTINUE; diff --git a/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch b/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch index 68fa8a91c2..1ceb2be25c 100644 --- a/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch +++ b/package/kernel/mac80211/patches/subsys/306-mac80211-set-up-the-fwd_skb-dev-for-mesh-forwarding.patch @@ -52,7 +52,7 @@ Signed-off-by: Xing Song --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c -@@ -2947,6 +2947,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 +@@ -2948,6 +2948,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 if (!fwd_skb) goto out; diff --git a/package/kernel/mac80211/patches/subsys/307-mac80211-do-not-access-the-IV-when-it-was-stripped.patch b/package/kernel/mac80211/patches/subsys/307-mac80211-do-not-access-the-IV-when-it-was-stripped.patch deleted file mode 100644 index 7b662acdc5..0000000000 --- a/package/kernel/mac80211/patches/subsys/307-mac80211-do-not-access-the-IV-when-it-was-stripped.patch +++ /dev/null @@ -1,26 +0,0 @@ -From: Xing Song -Date: Mon, 1 Nov 2021 10:46:57 +0800 -Subject: [PATCH] mac80211: do not access the IV when it was stripped - -ieee80211_get_keyid() will return false value if IV has been stripped, -such as return 0 for IP/ARP frames due to LLC header, and return -EINVAL -for disassociation frames due to its length... etc. Don't try to access -it if it's not present. - -Signed-off-by: Xing Song -Link: https://lore.kernel.org/r/20211101024657.143026-1-xing.song@mediatek.com -Signed-off-by: Johannes Berg ---- - ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -1952,7 +1952,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_ - int keyid = rx->sta->ptk_idx; - sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); - -- if (ieee80211_has_protected(fc)) { -+ if (ieee80211_has_protected(fc) && -+ !(status->flag & RX_FLAG_IV_STRIPPED)) { - cs = rx->sta->cipher_scheme; - keyid = ieee80211_get_keyid(rx->skb, cs); - diff --git a/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch b/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch deleted file mode 100644 index a408c3d802..0000000000 --- a/package/kernel/mac80211/patches/subsys/308-mac80211-fix-radiotap-header-generation.patch +++ /dev/null @@ -1,49 +0,0 @@ -From: Johannes Berg -Date: Tue, 9 Nov 2021 10:02:04 +0100 -Subject: [PATCH] mac80211: fix radiotap header generation - -In commit 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header -bitmap") we accidentally pointed the position to the wrong place, so -we overwrite a present bitmap, and thus cause all kinds of trouble. - -To see the issue, note that the previous code read: - - pos = (void *)(it_present + 1); - -The requirement now is that we need to calculate pos via it_optional, -to not trigger the compiler hardening checks, as: - - pos = (void *)&rthdr->it_optional[...]; - -Rewriting the original expression, we get (obviously, since that just -adds "+ x - x" terms): - - pos = (void *)(it_present + 1 + rthdr->it_optional - rthdr->it_optional) - -and moving the "+ rthdr->it_optional" outside to be used as an array: - - pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; - -The original is off by one, fix it. - -Cc: stable@vger.kernel.org -Fixes: 8c89f7b3d3f2 ("mac80211: Use flex-array for radiotap header bitmap") -Reported-by: Sid Hayn -Signed-off-by: Johannes Berg -Tested-by: Sid Hayn -Reviewed-by: Kees Cook -Link: https://lore.kernel.org/r/20211109100203.c61007433ed6.I1dade57aba7de9c4f48d68249adbae62636fd98c@changeid -Signed-off-by: Johannes Berg ---- - ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -364,7 +364,7 @@ ieee80211_add_rx_radiotap_header(struct - * the compiler to think we have walked past the end of the - * struct member. - */ -- pos = (void *)&rthdr->it_optional[it_present - rthdr->it_optional]; -+ pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; - - /* the order of the following fields is important */ - diff --git a/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch b/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch index b9fd8e3ea2..3df4062ec5 100644 --- a/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch +++ b/package/kernel/mac80211/patches/subsys/400-allow-ibss-mixed.patch @@ -5,7 +5,7 @@ and we should ignore this. --- a/net/wireless/core.c +++ b/net/wireless/core.c -@@ -629,21 +629,6 @@ static int wiphy_verify_combinations(str +@@ -630,21 +630,6 @@ static int wiphy_verify_combinations(str c->limits[j].max > 1)) return -EINVAL; diff --git a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch index 821032fa89..e0a259cde5 100644 --- a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch +++ b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch @@ -57,7 +57,7 @@ __NL80211_ATTR_AFTER_LAST, --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c -@@ -2760,6 +2760,19 @@ static int ieee80211_get_tx_power(struct +@@ -2764,6 +2764,19 @@ static int ieee80211_get_tx_power(struct return 0; } @@ -77,7 +77,7 @@ static void ieee80211_rfkill_poll(struct wiphy *wiphy) { struct ieee80211_local *local = wiphy_priv(wiphy); -@@ -4395,6 +4408,7 @@ const struct cfg80211_ops mac80211_confi +@@ -4399,6 +4412,7 @@ const struct cfg80211_ops mac80211_confi .set_wiphy_params = ieee80211_set_wiphy_params, .set_tx_power = ieee80211_set_tx_power, .get_tx_power = ieee80211_get_tx_power, @@ -137,7 +137,7 @@ }; /* policy for the key attributes */ -@@ -3324,6 +3325,22 @@ static int nl80211_set_wiphy(struct sk_b +@@ -3328,6 +3329,22 @@ static int nl80211_set_wiphy(struct sk_b if (result) goto out; } -- cgit v1.2.3