diff options
3 files changed, 229 insertions, 0 deletions
diff --git a/queue-6.6/series b/queue-6.6/series index 775d6d54301..93b29ac632f 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -229,3 +229,5 @@ selinux-fix-selinux_xfrm_alloc_user-to-set-correct-ctx_len.patch platform-x86-intel-uncore-freq-fail-module-load-when-plat_info-is-null.patch atm-revert-atm_account_tx-if-copy_from_iter_full-fails.patch input-sparcspkr-avoid-unannotated-fall-through.patch +wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch +wifi-rtw89-pci-use-dbi-function-for-8852ae-8852be-8851be.patch diff --git a/queue-6.6/wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch b/queue-6.6/wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch new file mode 100644 index 00000000000..d0cedf577f6 --- /dev/null +++ b/queue-6.6/wifi-cfg80211-init-wiphy_work-before-allocating-rfkill-fails.patch @@ -0,0 +1,98 @@ +From fc88dee89d7b63eeb17699393eb659aadf9d9b7c Mon Sep 17 00:00:00 2001 +From: Edward Adam Davis <eadavis@qq.com> +Date: Tue, 18 Mar 2025 11:13:45 +0800 +Subject: wifi: cfg80211: init wiphy_work before allocating rfkill fails + +From: Edward Adam Davis <eadavis@qq.com> + +commit fc88dee89d7b63eeb17699393eb659aadf9d9b7c upstream. + +syzbort reported a uninitialize wiphy_work_lock in cfg80211_dev_free. [1] + +After rfkill allocation fails, the wiphy release process will be performed, +which will cause cfg80211_dev_free to access the uninitialized wiphy_work +related data. + +Move the initialization of wiphy_work to before rfkill initialization to +avoid this issue. + +[1] +INFO: trying to register non-static key. +The code is fine but needs lockdep annotation, or maybe +you didn't initialize this object before use? +turning off the locking correctness validator. +CPU: 0 UID: 0 PID: 5935 Comm: syz-executor550 Not tainted 6.14.0-rc6-syzkaller-00103-g4003c9e78778 #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 +Call Trace: + <TASK> + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 + assign_lock_key kernel/locking/lockdep.c:983 [inline] + register_lock_class+0xc39/0x1240 kernel/locking/lockdep.c:1297 + __lock_acquire+0x135/0x3c40 kernel/locking/lockdep.c:5103 + lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 + cfg80211_dev_free+0x30/0x3d0 net/wireless/core.c:1196 + device_release+0xa1/0x240 drivers/base/core.c:2568 + kobject_cleanup lib/kobject.c:689 [inline] + kobject_release lib/kobject.c:720 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0x1e4/0x5a0 lib/kobject.c:737 + put_device+0x1f/0x30 drivers/base/core.c:3774 + wiphy_free net/wireless/core.c:1224 [inline] + wiphy_new_nm+0x1c1f/0x2160 net/wireless/core.c:562 + ieee80211_alloc_hw_nm+0x1b7a/0x2260 net/mac80211/main.c:835 + mac80211_hwsim_new_radio+0x1d6/0x54e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5185 + hwsim_new_radio_nl+0xb42/0x12b0 drivers/net/wireless/virtual/mac80211_hwsim.c:6242 + genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115 + genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] + genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210 + netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2533 + genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 + netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] + netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1338 + netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1882 + sock_sendmsg_nosec net/socket.c:718 [inline] + __sock_sendmsg net/socket.c:733 [inline] + ____sys_sendmsg+0xaaf/0xc90 net/socket.c:2573 + ___sys_sendmsg+0x135/0x1e0 net/socket.c:2627 + __sys_sendmsg+0x16e/0x220 net/socket.c:2659 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 + +Fixes: 72d520476a2f ("wifi: cfg80211: cancel wiphy_work before freeing wiphy") +Reported-by: syzbot+aaf0488c83d1d5f4f029@syzkaller.appspotmail.com +Close: https://syzkaller.appspot.com/bug?extid=aaf0488c83d1d5f4f029 +Tested-by: syzbot+aaf0488c83d1d5f4f029@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis <eadavis@qq.com> +Link: https://patch.msgid.link/tencent_258DD9121DDDB9DD9A1939CFAA0D8625B107@qq.com +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +Signed-off-by: WangYuli <wangyuli@uniontech.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + net/wireless/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -550,6 +550,9 @@ use_default_name: + INIT_WORK(&rdev->mgmt_registrations_update_wk, + cfg80211_mgmt_registrations_update_wk); + spin_lock_init(&rdev->mgmt_registrations_lock); ++ INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work); ++ INIT_LIST_HEAD(&rdev->wiphy_work_list); ++ spin_lock_init(&rdev->wiphy_work_lock); + + #ifdef CONFIG_CFG80211_DEFAULT_PS + rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT; +@@ -567,9 +570,6 @@ use_default_name: + return NULL; + } + +- INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work); +- INIT_LIST_HEAD(&rdev->wiphy_work_list); +- spin_lock_init(&rdev->wiphy_work_lock); + INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work); + INIT_WORK(&rdev->conn_work, cfg80211_conn_work); + INIT_WORK(&rdev->event_work, cfg80211_event_work); diff --git a/queue-6.6/wifi-rtw89-pci-use-dbi-function-for-8852ae-8852be-8851be.patch b/queue-6.6/wifi-rtw89-pci-use-dbi-function-for-8852ae-8852be-8851be.patch new file mode 100644 index 00000000000..fbedcda50a5 --- /dev/null +++ b/queue-6.6/wifi-rtw89-pci-use-dbi-function-for-8852ae-8852be-8851be.patch @@ -0,0 +1,129 @@ +From 9496d62f3877bc0f97b415bc04af98d092878026 Mon Sep 17 00:00:00 2001 +From: Chin-Yen Lee <timlee@realtek.com> +Date: Wed, 3 Jan 2024 09:23:46 +0800 +Subject: wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE + +From: Chin-Yen Lee <timlee@realtek.com> + +commit 9496d62f3877bc0f97b415bc04af98d092878026 upstream. + +Sometimes driver can't use kernel API pci_read/write_config_byte +to access the PCI config space of above address 0x100 due to +the negotiated PCI setting. 8852AE/8852BE/8851BE provide another +way called DBI function, which belongs to WiFi mac and could +access all PCI config space for this case. + +Link: https://lore.kernel.org/linux-wireless/79fe81b7db7148b9a7da2353c16d70fb@realtek.com/T/#t +Signed-off-by: Chin-Yen Lee <timlee@realtek.com> +Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> +Signed-off-by: Kalle Valo <kvalo@kernel.org> +Link: https://msgid.link/20240103012346.6822-1-pkshih@realtek.com +Signed-off-by: Zenm Chen <zenmchen@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/net/wireless/realtek/rtw89/pci.c | 69 ++++++++++++++++++++++++++++++- + drivers/net/wireless/realtek/rtw89/pci.h | 1 + 2 files changed, 68 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -1822,22 +1822,87 @@ static int rtw89_write16_mdio_clr(struct + return 0; + } + ++static int rtw89_dbi_write8(struct rtw89_dev *rtwdev, u16 addr, u8 data) ++{ ++ u16 addr_2lsb = addr & B_AX_DBI_2LSB; ++ u16 write_addr; ++ u8 flag; ++ int ret; ++ ++ write_addr = addr & B_AX_DBI_ADDR_MSK; ++ write_addr |= u16_encode_bits(BIT(addr_2lsb), B_AX_DBI_WREN_MSK); ++ rtw89_write8(rtwdev, R_AX_DBI_WDATA + addr_2lsb, data); ++ rtw89_write16(rtwdev, R_AX_DBI_FLAG, write_addr); ++ rtw89_write8(rtwdev, R_AX_DBI_FLAG + 2, B_AX_DBI_WFLAG >> 16); ++ ++ ret = read_poll_timeout_atomic(rtw89_read8, flag, !flag, 10, ++ 10 * RTW89_PCI_WR_RETRY_CNT, false, ++ rtwdev, R_AX_DBI_FLAG + 2); ++ if (ret) ++ rtw89_err(rtwdev, "failed to write DBI register, addr=0x%X\n", ++ addr); ++ ++ return ret; ++} ++ ++static int rtw89_dbi_read8(struct rtw89_dev *rtwdev, u16 addr, u8 *value) ++{ ++ u16 read_addr = addr & B_AX_DBI_ADDR_MSK; ++ u8 flag; ++ int ret; ++ ++ rtw89_write16(rtwdev, R_AX_DBI_FLAG, read_addr); ++ rtw89_write8(rtwdev, R_AX_DBI_FLAG + 2, B_AX_DBI_RFLAG >> 16); ++ ++ ret = read_poll_timeout_atomic(rtw89_read8, flag, !flag, 10, ++ 10 * RTW89_PCI_WR_RETRY_CNT, false, ++ rtwdev, R_AX_DBI_FLAG + 2); ++ if (ret) { ++ rtw89_err(rtwdev, "failed to read DBI register, addr=0x%X\n", ++ addr); ++ return ret; ++ } ++ ++ read_addr = R_AX_DBI_RDATA + (addr & 3); ++ *value = rtw89_read8(rtwdev, read_addr); ++ ++ return 0; ++} ++ + static int rtw89_pci_write_config_byte(struct rtw89_dev *rtwdev, u16 addr, + u8 data) + { + struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv; ++ enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id; + struct pci_dev *pdev = rtwpci->pdev; ++ int ret; + +- return pci_write_config_byte(pdev, addr, data); ++ ret = pci_write_config_byte(pdev, addr, data); ++ if (!ret) ++ return 0; ++ ++ if (chip_id == RTL8852A || chip_id == RTL8852B || chip_id == RTL8851B) ++ ret = rtw89_dbi_write8(rtwdev, addr, data); ++ ++ return ret; + } + + static int rtw89_pci_read_config_byte(struct rtw89_dev *rtwdev, u16 addr, + u8 *value) + { + struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv; ++ enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id; + struct pci_dev *pdev = rtwpci->pdev; ++ int ret; ++ ++ ret = pci_read_config_byte(pdev, addr, value); ++ if (!ret) ++ return 0; ++ ++ if (chip_id == RTL8852A || chip_id == RTL8852B || chip_id == RTL8851B) ++ ret = rtw89_dbi_read8(rtwdev, addr, value); + +- return pci_read_config_byte(pdev, addr, value); ++ return ret; + } + + static int rtw89_pci_config_byte_set(struct rtw89_dev *rtwdev, u16 addr, +--- a/drivers/net/wireless/realtek/rtw89/pci.h ++++ b/drivers/net/wireless/realtek/rtw89/pci.h +@@ -42,6 +42,7 @@ + #define B_AX_DBI_WFLAG BIT(16) + #define B_AX_DBI_WREN_MSK GENMASK(15, 12) + #define B_AX_DBI_ADDR_MSK GENMASK(11, 2) ++#define B_AX_DBI_2LSB GENMASK(1, 0) + #define R_AX_DBI_WDATA 0x1094 + #define R_AX_DBI_RDATA 0x1098 + |