ath6kl: avoid flush_scheduled_work() usage

As per commit c4f135d643823a86 ("workqueue: Wrap flush_workqueue() using
a macro") says, use per "struct ath6kl_usb" workqueue.

This is a blind conversion

ath6kl: avoid flush_scheduled_work() usage

As per commit c4f135d643823a86 ("workqueue: Wrap flush_workqueue() using
a macro") says, use per "struct ath6kl_usb" workqueue.

This is a blind conversion, and is only compile tested.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/f78ddbdc-8989-a1a7-2234-ce9ec3894625@I-love.SAKURA.ne.jp

show more ...

ath6kl: add device ID for WLU5150-D81

This device with a male Mini-B USB connector is part of Panasonic TVs.

Signed-off-by: André Apitzsch <git@apitzsch.eu>
Signed-off-by: Kalle Valo <quic_kvalo@qu

ath6kl: add device ID for WLU5150-D81

This device with a male Mini-B USB connector is part of Panasonic TVs.

Signed-off-by: André Apitzsch <git@apitzsch.eu>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220302211436.8746-1-git@apitzsch.eu

show more ...

ath6kl: fix division by zero in send path

Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in ath10k_usb_hif_tx_sg() in case a malicious device
has broken descri

ath6kl: fix division by zero in send path

Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in ath10k_usb_hif_tx_sg() in case a malicious device
has broken descriptors (or when doing descriptor fuzz testing).

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: 9cbee358687e ("ath6kl: add full USB support")
Cc: stable@vger.kernel.org # 3.5
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-3-johan@kernel.org

show more ...

ath6kl: fix control-message timeout

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 241b128b6b69 ("ath6kl: add back beginnings of

ath6kl: fix control-message timeout

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 241b128b6b69 ("ath6kl: add back beginnings of USB support")
Cc: stable@vger.kernel.org # 3.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-3-johan@kernel.org

show more ...

ath6kl: fix control-message timeout

commit a066d28a7e729f808a3e6eff22e70c003091544e upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG

ath6kl: fix control-message timeout

commit a066d28a7e729f808a3e6eff22e70c003091544e upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 241b128b6b69 ("ath6kl: add back beginnings of USB support")
Cc: stable@vger.kernel.org # 3.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

ath6kl: fix division by zero in send path

commit c1b9ca365deae667192be9fe24db244919971234 upstream.

Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in ath10k_u

ath6kl: fix division by zero in send path

commit c1b9ca365deae667192be9fe24db244919971234 upstream.

Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in ath10k_usb_hif_tx_sg() in case a malicious device
has broken descriptors (or when doing descriptor fuzz testing).

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: 9cbee358687e ("ath6kl: add full USB support")
Cc: stable@vger.kernel.org # 3.5
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

wireless: Fix trivial spelling

The word 'descriptor' is misspelled throughout the tree.

Fix it up accordingly:
decriptors -> descriptors

Signed-off-by: Kieran Bingham <kieran.bingham+renesas@i

wireless: Fix trivial spelling

The word 'descriptor' is misspelled throughout the tree.

Fix it up accordingly:
decriptors -> descriptors

Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200715124839.252822-5-kieran.bingham+renesas@ideasonboard.com

show more ...

ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()

The `ar_usb` field of `ath6kl_usb_pipe_usb_pipe` objects
are initialized to point to the containing `ath6kl_usb` object
according

ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()

The `ar_usb` field of `ath6kl_usb_pipe_usb_pipe` objects
are initialized to point to the containing `ath6kl_usb` object
according to endpoint descriptors read from the device side, as shown
below in `ath6kl_usb_setup_pipe_resources`:

for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
endpoint = &iface_desc->endpoint[i].desc;

// get the address from endpoint descriptor
pipe_num = ath6kl_usb_get_logical_pipe_num(ar_usb,
endpoint->bEndpointAddress,
&urbcount);
......
// select the pipe object
pipe = &ar_usb->pipes[pipe_num];

// initialize the ar_usb field
pipe->ar_usb = ar_usb;
}

The driver assumes that the addresses reported in endpoint
descriptors from device side to be complete. If a device is
malicious and does not report complete addresses, it may trigger
NULL-ptr-deref `ath6kl_usb_alloc_urb_from_pipe` and
`ath6kl_usb_free_urb_to_pipe`.

This patch fixes the bug by preventing potential NULL-ptr-deref
(CVE-2019-15098).

Signed-off-by: Hui Peng <benquike@gmail.com>
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

show more ...

ath6kl: constify usb_device_id

usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-

ath6kl: constify usb_device_id

usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-const structs as const.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Reviewed-by: Steve deRosier <derosier@gmail.com>
Tested-by: Steve deRosier <derosier@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: remove incorrect reset_resume handler

Existing implementation of reset_resume handler just calls
ath6kl_usb_remove() that deallocates all resources.
It can lead to double free, etc. on disco

ath6kl: remove incorrect reset_resume handler

Existing implementation of reset_resume handler just calls
ath6kl_usb_remove() that deallocates all resources.
It can lead to double free, etc. on disconnect.

The patch removes reset_resume handler,
so usb core could conservatively reset the driver.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: convert a driver to use module_usb_driver()

This converts a driver in drivers/net/* to use the
module_usb_driver() macro which makes the code smaller and a
bit simpler.

Signed-off-by: Himan

ath6kl: convert a driver to use module_usb_driver()

This converts a driver in drivers/net/* to use the
module_usb_driver() macro which makes the code smaller and a
bit simpler.

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: add support for ar6004 hw3.0

This change enables ath6kl driver to support ar6004 hw3.0. At the same time do
some fixes in firmware initialisation which applies to ar6004 hw1.3 as well.

Sign

ath6kl: add support for ar6004 hw3.0

This change enables ath6kl driver to support ar6004 hw3.0. At the same time do
some fixes in firmware initialisation which applies to ar6004 hw1.3 as well.

Signed-off-by: Jessica Wu <wjessica@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: convert ar6004 hardware flags to firmware feature flags

The functionality defined through these flags were actually firmware features
which can change between firmware versions. To make it p

ath6kl: convert ar6004 hardware flags to firmware feature flags

The functionality defined through these flags were actually firmware features
which can change between firmware versions. To make it possible to support
different firmware versions with the same driver, convert the flags to firmware
feature flags.

For backwards compatibility support for old ar6004 firmware FW
API 3 or smaller images we forcefully set the feature bits in the driver.
Starting from FW API 5 the firmware image needs to set them.

Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: fix blank lines before and after braces

Fixes checkpatch warnings:

CHECK: Blank lines aren't necessary after an open brace '{'
CHECK: Blank lines aren't necessary before a close brace '}'

ath6kl: fix blank lines before and after braces

Fixes checkpatch warnings:

CHECK: Blank lines aren't necessary after an open brace '{'
CHECK: Blank lines aren't necessary before a close brace '}'

Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: set rx urb count threshold to 1

Reduce the Rx count threshold to make sure we read
the available credits for Tx.

Signed-off-by: Julien Massot <jmassot@aldebaran-robotics.com>
Signed-off-by:

ath6kl: set rx urb count threshold to 1

Reduce the Rx count threshold to make sure we read
the available credits for Tx.

Signed-off-by: Julien Massot <jmassot@aldebaran-robotics.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: increase usb rx buffer size to 4096

With the previous value (1700), some urb are dropped
with a babble error (urb status equal -EOVERFLOW).

These error seems to only happen when urb length

ath6kl: increase usb rx buffer size to 4096

With the previous value (1700), some urb are dropped
with a babble error (urb status equal -EOVERFLOW).

These error seems to only happen when urb length is a
multiple of packet size (512).

Signed-off-by: Julien Massot <jmassot@aldebaran-robotics.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: Fix a suspend/resume crash in AR6004 USB

cfg80211 suspend/resume callbacks are not yet implemented
for AR6004 USB. Introduce dummy handlers for these to avoid
NULL pointer dereference.

Cc:

ath6kl: Fix a suspend/resume crash in AR6004 USB

cfg80211 suspend/resume callbacks are not yet implemented
for AR6004 USB. Introduce dummy handlers for these to avoid
NULL pointer dereference.

Cc: Sivanesan Rajapupathi <c_srajap@qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: Rename USB driver's suspend/resume/reset_resume

Rename USB driver's suspend/resume/reset_resume callbacks
with 'pm' prefix. This is necessary to differentiate it from
cfg80211/hif suspend/re

ath6kl: Rename USB driver's suspend/resume/reset_resume

Rename USB driver's suspend/resume/reset_resume callbacks
with 'pm' prefix. This is necessary to differentiate it from
cfg80211/hif suspend/resume/reset_resume callbacks.

Cc: Sivanesan Rajapupathi <c_srajap@qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath: changed kmalloc to kmemdup

Signed-off-by: Andrei Epure <epure.andrei@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath6kl: fix usb related error handling and warnings

It was annoying to debug usb warm reboot initialisation problems as many usb
related functions just ignored errors and it wasn't obvious from the

ath6kl: fix usb related error handling and warnings

It was annoying to debug usb warm reboot initialisation problems as many usb
related functions just ignored errors and it wasn't obvious from the kernel
logs what was failing. Fix all that so that error messages are printed and
errors are handled properly.

Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: remove unnecessary check for NULL skb

dev_kfree_skb kernel API itself takes for checking for NULL
skb, so an explicit check is not required.

Signed-off-by: Mohammed Shafi Shajakhan <mohamme

ath6kl: remove unnecessary check for NULL skb

dev_kfree_skb kernel API itself takes for checking for NULL
skb, so an explicit check is not required.

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: Fix mapping uplink endpoint for AR6004

AR6004(UB134) firmware supports only LP Endpoint, So map
all Access Categories to Low Priority endpoints. This fixes a WPA2
connection issue as the upl

ath6kl: Fix mapping uplink endpoint for AR6004

AR6004(UB134) firmware supports only LP Endpoint, So map
all Access Categories to Low Priority endpoints. This fixes a WPA2
connection issue as the uplink(tx) endpoint is appropriately
mapped in sync with the firmware.

Tested-by: Ben Gray <ben.r.gray@gmail.com>
Reported-by: Ben Gray <ben.r.gray@gmail.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: Return error case when ath6kl_usb_alloc_pipe_resources fails

Incase the resource allocation for the struct ath6kl_urb_context in the
function ath6kl_usb_alloc_pipe_resources fails, return th

ath6kl: Return error case when ath6kl_usb_alloc_pipe_resources fails

Incase the resource allocation for the struct ath6kl_urb_context in the
function ath6kl_usb_alloc_pipe_resources fails, return this error
case so that ath6kl_usb_probe is aware of this error case.

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: check usb_register() return value

ath6kl_usb_init() does not check usb_register() return value.
As a result it may incorrectly report success of driver initialization.

Found by Linux Driver

ath6kl: check usb_register() return value

ath6kl_usb_init() does not check usb_register() return value.
As a result it may incorrectly report success of driver initialization.

Found by Linux Driver Verification project (linuxtesting.org).

kvalo: fix commit title and make cosmetic changes to the code to follow
more the style used in the driver

Signed-off-by: Marina Makienko <makienko@ispras.ru>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: Add support for AR6004 hardware version 1.3

Add support for AR6004 hardware with version 1.3 and has
id 0x31c8088a.

Signed-off-by: Bala Shanmugam <bkamatch@qca.qualcomm.com>
Signed-off-by:

ath6kl: Add support for AR6004 hardware version 1.3

Add support for AR6004 hardware with version 1.3 and has
id 0x31c8088a.

Signed-off-by: Bala Shanmugam <bkamatch@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...