From patchwork Sat Dec 3 03:22:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ryder Lee X-Patchwork-Id: 630856 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1358AC4708E for ; Sat, 3 Dec 2022 03:22:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230042AbiLCDWo (ORCPT ); Fri, 2 Dec 2022 22:22:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42860 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229873AbiLCDWk (ORCPT ); Fri, 2 Dec 2022 22:22:40 -0500 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E5509F7A for ; Fri, 2 Dec 2022 19:22:36 -0800 (PST) X-UUID: 621310b373df4458a468c18ccea0f619-20221203 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=F3N+BXWVouR7PHRflmwklN0n51QgK3XV+XrOP4kaVCk=; b=ag9+AMTPWlSZ1l3aqzbiOYyHGEIT5lonwEVfMEthAp7zXliU7CKmU4dHc2Pf8e9PrIr8RVpUPIkACLXx65+S0hbP5B9pZiTqMP3SH9DGYT49logRN56S4A4opyrMT8PAzy//2TBHE++y5QhQoRzh0fYl5WDTmU/x9qsv5iY4teg=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.14, REQID:f116ad4c-9b3d-4cef-9cce-e88877434a03, IP:0, U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:dcaaed0, CLOUDID:4edc061f-5e1d-4ab5-ab8e-3e04efc02b30, B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0,EDM:-3,IP:nil,U RL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0 X-UUID: 621310b373df4458a468c18ccea0f619-20221203 Received: from mtkexhb01.mediatek.inc [(172.21.101.102)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1000535550; Sat, 03 Dec 2022 11:22:27 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs11n1.mediatek.inc (172.21.101.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Sat, 3 Dec 2022 11:22:26 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.792.15 via Frontend Transport; Sat, 3 Dec 2022 11:22:26 +0800 From: Ryder Lee To: Felix Fietkau , CC: Lorenzo Bianconi , Shayne Chen , Evelyn Tsai , , Ryder Lee Subject: [PATCH 1/4] wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks Date: Sat, 3 Dec 2022 11:22:22 +0800 Message-ID: X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-MTK: N Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Coverity message: variable "buf" going out of scope leaks the storage. Reported-by: coverity-bot Addresses-Coverity-ID: 1527799 ("Resource leaks") Fixes: e3296759f347 ("wifi: mt76: mt7915: enable per bandwidth power limit support") Signed-off-by: Ryder Lee --- drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c index fb46c2c1784f..a7fdcd1f3d98 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c @@ -996,7 +996,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf, ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr)); if (ret) - return ret; + goto out; /* Txpower propagation path: TMAC -> TXV -> BBP */ len += scnprintf(buf + len, sz - len, @@ -1047,6 +1047,8 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf, mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER)); ret = simple_read_from_buffer(user_buf, count, ppos, buf, len); + +out: kfree(buf); return ret; } From patchwork Sat Dec 3 03:22:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ryder Lee X-Patchwork-Id: 631549 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03807C47088 for ; Sat, 3 Dec 2022 03:22:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229991AbiLCDWn (ORCPT ); Fri, 2 Dec 2022 22:22:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42854 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229706AbiLCDWk (ORCPT ); Fri, 2 Dec 2022 22:22:40 -0500 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF1F1F77 for ; Fri, 2 Dec 2022 19:22:35 -0800 (PST) X-UUID: 3353c64176454ae08f09474457701c00-20221203 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=PNWSJ4pI2IkcKyFFE7f5GycSoRpgFBoM3xfG53SHE8M=; b=UKzcy7ydkLpu4gn2P83SY895TKu+Cr5GUo4xqJTQAz1klYut+SrWjg1yzKlii1oDANQ6a6+X1y4ze6Q6IdRv5cDOITp9eMbF6ljT+uMcGY6Fi9EEmMjit1fAYSPdc36xXQIKjMvh07aynDEqvJMabEj/bl+26jZDju+DhJ3vSUc=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.14, REQID:b07f776e-0be1-4f9d-a23f-b7e6d17a552c, IP:0, U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:dcaaed0, CLOUDID:af4d6e6c-41fe-47b6-8eb4-ec192dedaf7d, B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0,EDM:-3,IP:nil,U RL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0 X-UUID: 3353c64176454ae08f09474457701c00-20221203 Received: from mtkexhb01.mediatek.inc [(172.21.101.102)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1109948359; Sat, 03 Dec 2022 11:22:27 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs11n1.mediatek.inc (172.21.101.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Sat, 3 Dec 2022 11:22:26 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.792.15 via Frontend Transport; Sat, 3 Dec 2022 11:22:26 +0800 From: Ryder Lee To: Felix Fietkau , CC: Lorenzo Bianconi , Shayne Chen , Evelyn Tsai , , Ryder Lee Subject: [PATCH 2/4] wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_ie_countdown() Date: Sat, 3 Dec 2022 11:22:23 +0800 Message-ID: X-Mailer: git-send-email 2.18.0 In-Reply-To: References: MIME-Version: 1.0 X-MTK: N Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Coverity message: using tainted "hdr->band" variable as an index into an array "(*dev).mt76.phys". Reported-by: coverity-bot Addresses-Coverity-ID: 1527797 ("Insecure data handling") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index 04e1d10bbd21..a90b7ca2df63 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -412,6 +412,9 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb) struct header *hdr = (struct header *)data; struct tlv *tlv = (struct tlv *)(data + 4); + if (hdr->band >= ARRAY_SIZE(dev->mt76.phys)) + return; + if (hdr->band && dev->mt76.phys[hdr->band]) mphy = dev->mt76.phys[hdr->band]; From patchwork Sat Dec 3 03:22:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ryder Lee X-Patchwork-Id: 631550 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF9EFC4321E for ; Sat, 3 Dec 2022 03:22:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229980AbiLCDWm (ORCPT ); Fri, 2 Dec 2022 22:22:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229823AbiLCDWk (ORCPT ); Fri, 2 Dec 2022 22:22:40 -0500 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF5A2C7B for ; Fri, 2 Dec 2022 19:22:34 -0800 (PST) X-UUID: 9134f955d1ee4410b1568388475e1767-20221203 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=qxn7s+B8JwIhyxqEztH5T76ucl3+tCcdpJ0sd79qP5U=; b=GlyurQg0hDhXCAHJwe9KQLTJ2xdTpOHb4KKryRzBrolkUy2SDC/GrRtCuCx6jFlIEDCPjJ6ivyvmfGON1oo0jC8Vai4/2lGyvSSeLsHptVN+EOYJ8vauxnJS9hjQMZuwrlfZyVC9Rk3i9GxCYFrvK+VnDyikXPT2vtqGh7HjYXo=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.14, REQID:a670c786-6979-4aa1-855d-c104c6483707, IP:0, U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:dcaaed0, CLOUDID:b04d6e6c-41fe-47b6-8eb4-ec192dedaf7d, B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0,EDM:-3,IP:nil,U RL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0 X-UUID: 9134f955d1ee4410b1568388475e1767-20221203 Received: from mtkexhb01.mediatek.inc [(172.21.101.102)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 1787189263; Sat, 03 Dec 2022 11:22:28 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs10n1.mediatek.inc (172.21.101.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Sat, 3 Dec 2022 11:22:27 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.792.15 via Frontend Transport; Sat, 3 Dec 2022 11:22:27 +0800 From: Ryder Lee To: Felix Fietkau , CC: Lorenzo Bianconi , Shayne Chen , Evelyn Tsai , , Ryder Lee Subject: [PATCH 3/4] wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_rx_radar_detected() Date: Sat, 3 Dec 2022 11:22:24 +0800 Message-ID: <924d203f061a5bf98c4ade208a88d27b68b2730b.1670037462.git.ryder.lee@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: References: MIME-Version: 1.0 X-MTK: N Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Coverity message: using tainted "r->band_idx" variable as an index into an array "(*dev).mt76.phys". Reported-by: coverity-bot Addresses-Coverity-ID: 1527812 ("Insecure data handling") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index a90b7ca2df63..efb245c8ac84 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -335,6 +335,9 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb) r = (struct mt7996_mcu_rdd_report *)skb->data; + if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys)) + return; + mphy = dev->mt76.phys[r->band_idx]; if (!mphy) return; From patchwork Sat Dec 3 03:22:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ryder Lee X-Patchwork-Id: 630855 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DDB8FC4321E for ; Sat, 3 Dec 2022 03:22:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229823AbiLCDWq (ORCPT ); Fri, 2 Dec 2022 22:22:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42850 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229951AbiLCDWk (ORCPT ); Fri, 2 Dec 2022 22:22:40 -0500 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 162202FD for ; Fri, 2 Dec 2022 19:22:33 -0800 (PST) X-UUID: d9907b2a07a443dfb5beed627964e14c-20221203 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=CLA0MJYAKVZmh7ivBYheuQmNw2QpaVtX8ZoW3soALIU=; b=UpZVMi9CfXfJWmChECCGz0rqNtJb3JOY9Lbpi+blYeDZy6PSUfP5u1ahOTIhDXkfRdXZCpyDODHMLQ+yr0Cb+MCIUAS2mwQhnVw/gvxDpyWexxBciZwj4Uhe0ccIE1Za6VKf0kPbfC9x+l01vroteUqwZoufm8poB5pBUIAfUko=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.14, REQID:564e6acf-a564-428e-93ef-bfe47caf3e80, IP:0, U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:dcaaed0, CLOUDID:2a6b8b30-2938-482e-aafd-98d66723b8a9, B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0,EDM:-3,IP:nil,U RL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0 X-UUID: d9907b2a07a443dfb5beed627964e14c-20221203 Received: from mtkexhb01.mediatek.inc [(172.21.101.102)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 465167930; Sat, 03 Dec 2022 11:22:28 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs10n1.mediatek.inc (172.21.101.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Sat, 3 Dec 2022 11:22:28 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.792.15 via Frontend Transport; Sat, 3 Dec 2022 11:22:28 +0800 From: Ryder Lee To: Felix Fietkau , CC: Lorenzo Bianconi , Shayne Chen , Evelyn Tsai , , Ryder Lee Subject: [PATCH 4/4] wifi: mt76: mt7996: fix integer handling issue of mt7996_rf_regval_set() Date: Sat, 3 Dec 2022 11:22:25 +0800 Message-ID: X-Mailer: git-send-email 2.18.0 In-Reply-To: References: MIME-Version: 1.0 X-MTK: N Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org This code is supposed to set a u32 value, but casting will not work on big endian systems. Reported-by: coverity-bot Addresses-Coverity-ID: 1527816 ("Integer handling issues") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee --- drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c index 2e4a8909b9e8..99b23aef53a5 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c @@ -653,8 +653,9 @@ static int mt7996_rf_regval_set(void *data, u64 val) { struct mt7996_dev *dev = data; + u32 val32 = val; - return mt7996_mcu_rf_regval(dev, dev->mt76.debugfs_reg, (u32 *)&val, true); + return mt7996_mcu_rf_regval(dev, dev->mt76.debugfs_reg, &val32, true); } DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get,