From patchwork Fri Apr 23 14:27:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 426634 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45A0DC433B4 for ; Fri, 23 Apr 2021 14:27:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1480C61406 for ; Fri, 23 Apr 2021 14:27:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238664AbhDWO15 (ORCPT ); Fri, 23 Apr 2021 10:27:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:48746 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231220AbhDWO14 (ORCPT ); Fri, 23 Apr 2021 10:27:56 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id F0B3161464; Fri, 23 Apr 2021 14:27:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1619188040; bh=bzEpUG9DtwoR6hryB1/VQuL1aDl3S1f0W3cgUrKLaRA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cDWveOk9baAuLixDQllNkV50W5X8sUgR9xzHAmb4d4UlZ25cP7LRHqHv+JIK5Dzef +f5daCtWtll9194WGhx52jYNDcYXkpu9Ko97K5LCvidWBKZgdXWUaCcly3XnaVFl2V 5vBWYPyLY1/V6CQXFLx7H8gl9zRFgqhpYRAmUpR505I50rvxJeyUP4RSL+rrgDcSuM T05YKuVF1TQr31ycQDwUgt1iHnXdK6nhsbU5eSmfirToWKhJTXoeaOt4t7lMjB/8g4 e0MBT5fVeoWk54OcQK8Qjr4nS/8Zg3nwwanWcg4VvJUfXSKy4OBC/0LJDa26i8V8AF j3LN86frohodQ== From: Lorenzo Bianconi To: nbd@nbd.name Cc: linux-wireless@vger.kernel.org, lorenzo.bianconi@redhat.com, sean.wang@mediatek.com, kvalo@codeaurora.org Subject: [PATCH 1/3] mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report Date: Fri, 23 Apr 2021 16:27:09 +0200 Message-Id: <91a1e8f6b6a3e6a929de560ed68132f6eb421720.1619187875.git.lorenzo@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Fix possible array out of bound access in mt7921_mcu_tx_rate_report. Remove unnecessary varibable in mt7921_mcu_tx_rate_report Fixes: 1c099ab44727c ("mt76: mt7921: add MCU support") Signed-off-by: Lorenzo Bianconi --- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c index 5f3d56d570a5..67dc4b4cc094 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c @@ -402,20 +402,22 @@ static void mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb, u16 wlan_idx) { - struct mt7921_mcu_wlan_info_event *wtbl_info = - (struct mt7921_mcu_wlan_info_event *)(skb->data); - struct rate_info rate = {}; - u8 curr_idx = wtbl_info->rate_info.rate_idx; - u16 curr = le16_to_cpu(wtbl_info->rate_info.rate[curr_idx]); - struct mt7921_mcu_peer_cap peer = wtbl_info->peer_cap; + struct mt7921_mcu_wlan_info_event *wtbl_info; struct mt76_phy *mphy = &dev->mphy; struct mt7921_sta_stats *stats; + struct rate_info rate = {}; struct mt7921_sta *msta; struct mt76_wcid *wcid; + u8 idx; if (wlan_idx >= MT76_N_WCIDS) return; + wtbl_info = (struct mt7921_mcu_wlan_info_event *)skb->data; + idx = wtbl_info->rate_info.rate_idx; + if (idx >= ARRAY_SIZE(wtbl_info->rate_info.rate)) + return; + rcu_read_lock(); wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]); @@ -426,7 +428,8 @@ mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb, stats = &msta->stats; /* current rate */ - mt7921_mcu_tx_rate_parse(mphy, &peer, &rate, curr); + mt7921_mcu_tx_rate_parse(mphy, &wtbl_info->peer_cap, &rate, + le16_to_cpu(wtbl_info->rate_info.rate[idx])); stats->tx_rate = rate; out: rcu_read_unlock(); From patchwork Fri Apr 23 14:27:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 427137 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9354FC43460 for ; Fri, 23 Apr 2021 14:27:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5FA4961406 for ; Fri, 23 Apr 2021 14:27:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238948AbhDWO17 (ORCPT ); Fri, 23 Apr 2021 10:27:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:48772 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231220AbhDWO16 (ORCPT ); Fri, 23 Apr 2021 10:27:58 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 0B54661458; Fri, 23 Apr 2021 14:27:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1619188042; bh=aITc/pZfy1qNBuVq26SnstCbkA/88XdjtDeFYLQaN9k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GaXeIqDidi4LlD68CjZJNrWbhu+7dobfvkCDB2eZIgLLZOtEPDui9Mkda1vm+fRiE GddMXK5/Bt7YULCvBZphD14ZC1+wLNfqCZAQSFIA4g7ed+Itcnl9g1CMZFqrpWv6gJ K13BaCGXgwwNWgrKU4qTvFJYH5QG7Kg06r8pNfIngi5hIa3Mb6m2iWCIpKA/bfywZm VgrQKc0WGyHHsViobNz6F0Fl4x7cBmf2meU+LzSYvZrXKPtaXpvKFttZw+d1sUoXtq uWX0RAV5OCXs7cSQuCHdhUyUB0VF1zmXPb2EK1v9UXGDxpd1YQBhGmKwhvspjUVmLO BuYEAFlPjGtdQ== From: Lorenzo Bianconi To: nbd@nbd.name Cc: linux-wireless@vger.kernel.org, lorenzo.bianconi@redhat.com, sean.wang@mediatek.com, kvalo@codeaurora.org Subject: [PATCH 2/3] mt76: connac: do not schedule wake_work if the runtime-pm is disabled Date: Fri, 23 Apr 2021 16:27:10 +0200 Message-Id: X-Mailer: git-send-email 2.30.2 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Fix the following crash due to a call to mt7921_pm_wake_work if the device has pm disabled or does not support runtime-pm [ 8.412590] mt7921e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build [ 8.413660] WARNING: CPU: 0 PID: 20 at __queue_delayed_work+0x84/0xb0 [ 8.481831] CPU: 0 PID: 20 Comm: kworker/u4:1 Not tainted 5.10.31 #0 [ 8.488175] Hardware name: MediaTek MT7622 RFB1 board (DT) [ 8.493663] Workqueue: mt76 mt7921_pm_wake_work [mt7921e] [ 8.499055] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--) [ 8.505052] pc : __queue_delayed_work+0x84/0xb0 [ 8.509574] lr : queue_delayed_work_on+0x54/0x78 [ 8.514180] sp : ffffffc010bcbd20 [ 8.517485] x29: ffffffc010bcbd20 x28: 0000000000000000 [ 8.522790] x27: ffffff800015a148 x26: ffffffc0108acae0 [ 8.528094] x25: 0000000000000000 x24: ffffff80056b4208 [ 8.533399] x23: ffffff80056b26e0 x22: ffffff80056b26e0 [ 8.538703] x21: ffffff80056b45f8 x20: ffffff80056b5dc8 [ 8.544006] x19: 0000000000000000 x18: 000000000000000e [ 8.549310] x17: 0000000000000001 x16: 0000000000000019 [ 8.554614] x15: 0000000000000033 x14: ffffffffffffffff [ 8.559919] x13: ffffffffffffffff x12: 0000000000000000 [ 8.565223] x11: 0000000000000040 x10: 0000000000000820 [ 8.570528] x9 : 0000b3c738feafd6 x8 : ffffff801feb7c80 [ 8.575832] x7 : ffffff80056b4808 x6 : 0000000000000000 [ 8.581136] x5 : ffffff80056b2888 x4 : 0000000fffffffe0 [ 8.586441] x3 : 000000000000003e x2 : ffffff80056b2868 [ 8.591745] x1 : 0000000000000000 x0 : 0000000000000002 [ 8.597049] Call trace: [ 8.599488] __queue_delayed_work+0x84/0xb0 [ 8.603662] queue_delayed_work_on+0x54/0x78 [ 8.607947] ieee80211_queue_delayed_work+0x30/0x50 [mac80211] [ 8.613774] mt7921_pm_wake_work+0xa0/0xe0 [mt7921e] [ 8.618730] process_one_work+0x1fc/0x398 [ 8.622730] worker_thread+0x150/0x4e0 [ 8.626472] kthread+0x120/0x128 [ 8.629693] ret_from_fork+0x10/0x18 Fixes: 129fac01ffe85 ("mt76: connac: introduce wake counter for fw_pmctrl synchronization") Signed-off-by: Lorenzo Bianconi --- drivers/net/wireless/mediatek/mt76/mt76_connac.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac.h index 6c889b90fd12..2b1150bf8d3d 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76_connac.h +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac.h @@ -103,6 +103,9 @@ mt76_connac_pm_ref(struct mt76_phy *phy, struct mt76_connac_pm *pm) { bool ret = false; + if (!pm->enable) + return true; + spin_lock_bh(&pm->wake.lock); if (test_bit(MT76_STATE_PM, &phy->state)) goto out; @@ -118,6 +121,9 @@ mt76_connac_pm_ref(struct mt76_phy *phy, struct mt76_connac_pm *pm) static inline void mt76_connac_pm_unref(struct mt76_connac_pm *pm) { + if (!pm->enable) + return; + spin_lock_bh(&pm->wake.lock); pm->wake.count--; pm->last_activity = jiffies; From patchwork Fri Apr 23 14:27:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 426633 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5372C433ED for ; Fri, 23 Apr 2021 14:27:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 831ED61450 for ; Fri, 23 Apr 2021 14:27:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239066AbhDWO2A (ORCPT ); Fri, 23 Apr 2021 10:28:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:48798 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238918AbhDWO2A (ORCPT ); Fri, 23 Apr 2021 10:28:00 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 14C096141C; Fri, 23 Apr 2021 14:27:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1619188044; bh=835O6aF5aOFD0RLTg7zJDzDxfjv8h4WJpuNJyNW5v8M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JYE4Z7Nkyjky8w9jAVu6iu+xA7qQZwGfI61Xmax1skkkxfvNcb/9+YGCoGYIroI+x gOaXQycGIQqX8D8kqVdnsqfTOOB3SQbT+UniemnsBlWopKhkW7MFDpYUQPsDJqU926 SIEbJgE25/OgjOVprC/ajwhMRVN3PSl+NT96hfusuBSx2wjYndQDDwG/SKR1qBbDVU MHsHMGqGQcL5u8Y7Ui34QtxXmuVCVDjilaDQFyDTUKjBo4iwMvdzZjl6nXOFr0zU2c L5kkodB8SovPh9WghKQSRhZiim/a8Zwb9eOTVoLYoJiUp+7DW3rxA7ZsPD48+Rqk82 6YOyPgCPmlHsQ== From: Lorenzo Bianconi To: nbd@nbd.name Cc: linux-wireless@vger.kernel.org, lorenzo.bianconi@redhat.com, sean.wang@mediatek.com, kvalo@codeaurora.org Subject: [PATCH 3/3] mt76: connac: do not schedule mac_work if the device is not running Date: Fri, 23 Apr 2021 16:27:11 +0200 Message-Id: <5bfd36a75799c37b12fcb54d17e77fbc2c7a0558.1619187875.git.lorenzo@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Do not run ieee80211_queue_delayed_work for mac work if the worqueue is not initialized yet Fixes: b1bd7bb8121d ("mt76: connac: unschedule mac_work before going to sleep") Signed-off-by: Lorenzo Bianconi --- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 5 +++-- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c index f81a17d56008..e2dcfee6be81 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c @@ -1912,8 +1912,9 @@ void mt7615_pm_wake_work(struct work_struct *work) napi_schedule(&dev->mt76.napi[i]); mt76_connac_pm_dequeue_skbs(mphy, &dev->pm); mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_WM], false); - ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work, - MT7615_WATCHDOG_TIME); + if (test_bit(MT76_STATE_RUNNING, &mphy->state)) + ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work, + MT7615_WATCHDOG_TIME); } ieee80211_wake_queues(mphy->hw); diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c index 214bd1859792..decf2d5f0ce3 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c @@ -1404,8 +1404,9 @@ void mt7921_pm_wake_work(struct work_struct *work) napi_schedule(&dev->mt76.napi[i]); mt76_connac_pm_dequeue_skbs(mphy, &dev->pm); mt7921_tx_cleanup(dev); - ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work, - MT7921_WATCHDOG_TIME); + if (test_bit(MT76_STATE_RUNNING, &mphy->state)) + ieee80211_queue_delayed_work(mphy->hw, &mphy->mac_work, + MT7921_WATCHDOG_TIME); } ieee80211_wake_queues(mphy->hw);