mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-23 23:42:43 +00:00
930e702d72
Synchronize the ath11k backports with the current ath-next tree. This replaces the management TLV pending fix with the upstreamed one, fixes traffic flooding when AP and monitor modes are used at the same time, fixes QCN9074 always showing -95 dBm for station RSSI in dumps, fixes potential crash on boot if spectral scan is enabled due to writing to unitialized memory and adds 11d scan offloading for WCN6750 and WCN6855. Signed-off-by: Robert Marko <robimarko@gmail.com>
44 lines
1.7 KiB
Diff
44 lines
1.7 KiB
Diff
From 756a7f90878f0866fd2fe167ef37e90b47326b96 Mon Sep 17 00:00:00 2001
|
|
From: P Praneesh <quic_ppranees@quicinc.com>
|
|
Date: Fri, 24 Mar 2023 16:57:01 +0200
|
|
Subject: [PATCH] wifi: ath11k: fix writing to unintended memory region
|
|
|
|
While initializing spectral, the magic value is getting written to the
|
|
invalid memory address leading to random boot-up crash. This occurs
|
|
due to the incorrect index increment in ath11k_dbring_fill_magic_value
|
|
function. Fix it by replacing the existing logic with memset32 to ensure
|
|
there is no invalid memory access.
|
|
|
|
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1
|
|
|
|
Fixes: d3d358efc553 ("ath11k: add spectral/CFR buffer validation support")
|
|
Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
|
|
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
|
|
Link: https://lore.kernel.org/r/20230321052900.16895-1-quic_ppranees@quicinc.com
|
|
---
|
|
drivers/net/wireless/ath/ath11k/dbring.c | 12 ++++++------
|
|
1 file changed, 6 insertions(+), 6 deletions(-)
|
|
|
|
--- a/drivers/net/wireless/ath/ath11k/dbring.c
|
|
+++ b/drivers/net/wireless/ath/ath11k/dbring.c
|
|
@@ -26,13 +26,13 @@ int ath11k_dbring_validate_buffer(struct
|
|
static void ath11k_dbring_fill_magic_value(struct ath11k *ar,
|
|
void *buffer, u32 size)
|
|
{
|
|
- u32 *temp;
|
|
- int idx;
|
|
+ /* memset32 function fills buffer payload with the ATH11K_DB_MAGIC_VALUE
|
|
+ * and the variable size is expected to be the number of u32 values
|
|
+ * to be stored, not the number of bytes.
|
|
+ */
|
|
+ size = size / sizeof(u32);
|
|
|
|
- size = size >> 2;
|
|
-
|
|
- for (idx = 0, temp = buffer; idx < size; idx++, temp++)
|
|
- *temp++ = ATH11K_DB_MAGIC_VALUE;
|
|
+ memset32(buffer, ATH11K_DB_MAGIC_VALUE, size);
|
|
}
|
|
|
|
static int ath11k_dbring_bufs_replenish(struct ath11k *ar,
|