30 Oct, 2020

1 commit

  • Fix follow warning:
    [net/wireless/reg.c:3619]: (warning) %d in format string (no. 2)
    requires 'int' but the argument type is 'unsigned int'.

    Reported-by: Hulk Robot
    Signed-off-by: Ye Bin
    Link: https://lore.kernel.org/r/20201009070215.63695-1-yebin10@huawei.com
    Signed-off-by: Johannes Berg

    Ye Bin
     

28 Sep, 2020

1 commit

  • The the __freq_reg_info() never returns NULL and the callers don't check
    for NULL. This initialization to set "reg_rule = NULL;" is just there
    to make GCC happy but it's not required in current GCCs.

    The problem is that Smatch sees the initialization and concludes that
    this function can return NULL so it complains that the callers are not
    checking for it.

    Smatch used to be able to parse this correctly but we recently changed
    the code from:

    - for (bw = MHZ_TO_KHZ(20); bw >= min_bw; bw = bw / 2) {
    + for (bw = MHZ_TO_KHZ(bws[i]); bw >= min_bw; bw = MHZ_TO_KHZ(bws[i--])) {

    Originally Smatch used to understand that this code always iterates
    through the loop once, but the change from "MHZ_TO_KHZ(20)" to
    "MHZ_TO_KHZ(bws[i])" is too complicated for Smatch.

    Signed-off-by: Dan Carpenter
    Link: https://lore.kernel.org/r/20200923084203.GC1454948@mwanda
    Signed-off-by: Johannes Berg

    Dan Carpenter
     

18 Sep, 2020

1 commit


05 Sep, 2020

1 commit

  • We got slightly different patches removing a double word
    in a comment in net/ipv4/raw.c - picked the version from net.

    Simple conflict in drivers/net/ethernet/ibm/ibmvnic.c. Use cached
    values instead of VNIC login response buffer (following what
    commit 507ebe6444a4 ("ibmvnic: Fix use-after-free of VNIC login
    response buffer") did).

    Signed-off-by: Jakub Kicinski

    Jakub Kicinski
     

27 Aug, 2020

4 commits

  • Some usable channels are located in the union of adjacent
    regulatory rules, for example channel 144 in Germany.

    Enable them, by also checking if a channel spans two adjacent
    regulatory rules/frequency ranges.

    All flags involved are disabling things, therefore we can build
    the maximum by or-ing them together. Furthermore, take the maximum
    of DFS CAC time values and the minimum of allowed power of both
    adjacent channels in order to comply with both regulatory rules at
    the same time.

    Signed-off-by: Markus Theil
    Link: https://lore.kernel.org/r/20200803144353.305538-2-markus.theil@tu-ilmenau.de
    [remove unrelated comment changes]
    Signed-off-by: Johannes Berg

    Markus Theil
     
  • As a preparation to handle adjacent rule channels,
    factor out handling channels located in a single
    regulatory rule.

    Signed-off-by: Markus Theil
    Link: https://lore.kernel.org/r/20200803144353.305538-1-markus.theil@tu-ilmenau.de
    Signed-off-by: Johannes Berg

    Markus Theil
     
  • Drop duplicated words "was" and "does".
    Fix "let's" apostrophe.

    Signed-off-by: Randy Dunlap
    Cc: Johannes Berg
    Cc: Kalle Valo
    Cc: linux-wireless@vger.kernel.org
    Link: https://lore.kernel.org/r/20200822231953.465-5-rdunlap@infradead.org
    Signed-off-by: Johannes Berg

    Randy Dunlap
     
  • Reject invalid hints early in order to not cause a kernel
    WARN later if they're restored to or similar.

    Reported-by: syzbot+d451401ffd00a60677ee@syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?extid=d451401ffd00a60677ee
    Link: https://lore.kernel.org/r/20200819084648.13956-1-johannes@sipsolutions.net
    Signed-off-by: Johannes Berg

    Johannes Berg
     

14 Jul, 2020

1 commit


24 Apr, 2020

1 commit

  • Some bands (S1G) define channels centered on a non-integer
    MHz. Give ieee80211_channel and cfg80211_chan_def a
    freq_offset component where the final frequency can be
    expressed as:

    MHZ_TO_KHZ(chan->center_freq) + chan->freq_offset;

    Also provide some helper functions to do the frequency
    conversion and test for equality.

    Retain the existing interface to frequency and channel
    conversion helpers, and expose new ones which handle
    frequencies in units of KHz.

    Some internal functions (net/wireless/chan.c) pass around
    a frequency value. Convert these to units of KHz.

    mesh, ibss, wext, etc. are currently ignored.

    Signed-off-by: Thomas Pedersen
    Link: https://lore.kernel.org/r/20200402011810.22947-3-thomas@adapt-ip.com
    Signed-off-by: Johannes Berg

    Thomas Pedersen
     

28 Feb, 2020

1 commit


21 Feb, 2020

1 commit


17 Feb, 2020

1 commit


07 Feb, 2020

1 commit

  • The regulatory domain might forbid HE operation. Certain regulatory
    domains may restrict it for specific channels whereas others may do it
    for the whole regulatory domain.

    Add an option to indicate it in the channel flag.

    Signed-off-by: Haim Dreyfuss
    Signed-off-by: Luca Coelho
    Link: https://lore.kernel.org/r/20200121081213.733757-1-luca@coelho.fi
    Signed-off-by: Johannes Berg

    Haim Dreyfuss
     

15 Jan, 2020

2 commits

  • In case a radar event of CAC_FINISHED or RADAR_DETECTED
    happens during another phy is during CAC we might need
    to cancel that CAC.

    If we got a radar in a channel that another phy is now
    doing CAC on then the CAC should be canceled there.

    If, for example, 2 phys doing CAC on the same channels,
    or on comptable channels, once on of them will finish his
    CAC the other might need to cancel his CAC, since it is no
    longer relevant.

    To fix that the commit adds an callback and implement it in
    mac80211 to end CAC.
    This commit also adds a call to said callback if after a radar
    event we see the CAC is no longer relevant

    Signed-off-by: Orr Mazor
    Reviewed-by: Sergey Matyukevich
    Link: https://lore.kernel.org/r/20191222145449.15792-1-Orr.Mazor@tandemg.com
    [slightly reformat/reword commit message]
    Signed-off-by: Johannes Berg

    Orr Mazor
     
  • Commit e33e2241e272 ("Revert "cfg80211: Use 5MHz bandwidth by
    default when checking usable channels"") fixed a broken
    regulatory (leaving channel 12 open for AP where not permitted).
    Apply a similar fix to custom regulatory domain processing.

    Signed-off-by: Cathy Luo
    Signed-off-by: Ganapathi Bhat
    Link: https://lore.kernel.org/r/1576836859-8945-1-git-send-email-ganapathi.bhat@nxp.com
    [reword commit message, fix coding style, add a comment]
    Signed-off-by: Johannes Berg

    Ganapathi Bhat
     

08 Oct, 2019

1 commit

  • In non-ETSI regulatory domains scan is blocked when operating channel
    is a DFS channel. For ETSI, however, once DFS channel is marked as
    available after the CAC, this channel will remain available (for some
    time) even after leaving this channel.

    Therefore a scan can be done without any impact on the availability
    of the DFS channel as no new CAC is required after the scan.

    Enable scan in mac80211 in these cases.

    Signed-off-by: Aaron Komisar
    Link: https://lore.kernel.org/r/1570024728-17284-1-git-send-email-aaron.komisar@tandemg.com
    Signed-off-by: Johannes Berg

    Aaron Komisar
     

01 Oct, 2019

1 commit

  • In a few places we don't properly initialize on-stack chandefs,
    resulting in EDMG data to be non-zero, which broke things.

    Additionally, in a few places we rely on the driver to init the
    data completely, but perhaps we shouldn't as non-EDMG drivers
    may not initialize the EDMG data, also initialize it there.

    Cc: stable@vger.kernel.org
    Fixes: 2a38075cd0be ("nl80211: Add support for EDMG channels")
    Reported-by: Dmitry Osipenko
    Tested-by: Dmitry Osipenko
    Link: https://lore.kernel.org/r/1569239475-I2dcce394ecf873376c386a78f31c2ec8b538fa25@changeid
    Signed-off-by: Johannes Berg

    Johannes Berg
     

28 Aug, 2019

1 commit


21 Aug, 2019

2 commits

  • For the new 6GHz there are new UNII band definitions as listed
    in the FCC notice [1].

    [1] https://docs.fcc.gov/public/attachments/FCC-18-147A1_Rcd.pdf

    Reviewed-by: Pieter-Paul Giesberts
    Reviewed-by: Leon Zegers
    Signed-off-by: Arend van Spriel
    Link: https://lore.kernel.org/r/1564745465-21234-3-git-send-email-arend.vanspriel@broadcom.com
    Signed-off-by: Johannes Berg

    Arend van Spriel
     
  • This reverts commit 96cce12ff6e0 ("cfg80211: fix processing world
    regdomain when non modular").

    Re-triggering a reg_process_hint with the last request on all events,
    can make the regulatory domain fail in case of multiple WiFi modules. On
    slower boards (espacially with mdev), enumeration of the WiFi modules
    can end up in an intersected regulatory domain, and user cannot set it
    with 'iw reg set' anymore.

    This is happening, because:
    - 1st module enumerates, queues up a regulatory request
    - request gets processed by __reg_process_hint_driver():
    - checks if previous was set by CORE -> yes
    - checks if regulator domain changed -> yes, from '00' to e.g. 'US'
    -> sends request to the 'crda'
    - 2nd module enumerates, queues up a regulator request (which triggers
    the reg_todo() work)
    - reg_todo() -> reg_process_pending_hints() sees, that the last request
    is not processed yet, so it tries to process it again.
    __reg_process_hint driver() will run again, and:
    - checks if the last request's initiator was the core -> no, it was
    the driver (1st WiFi module)
    - checks, if the previous initiator was the driver -> yes
    - checks if the regulator domain changed -> yes, it was '00' (set by
    core, and crda call did not return yet), and should be changed to 'US'

    ------> __reg_process_hint_driver calls an intersect

    Besides, the reg_process_hint call with the last request is meaningless
    since the crda call has a timeout work. If that timeout expires, the
    first module's request will lost.

    Cc: stable@vger.kernel.org
    Fixes: 96cce12ff6e0 ("cfg80211: fix processing world regdomain when non modular")
    Signed-off-by: Robert Hodaszi
    Link: https://lore.kernel.org/r/20190614131600.GA13897@a1-hr
    Signed-off-by: Johannes Berg

    Hodaszi, Robert
     

11 Jul, 2019

1 commit

  • …el/git/dhowells/linux-fs"

    This reverts merge 0f75ef6a9cff49ff612f7ce0578bced9d0b38325 (and thus
    effectively commits

    7a1ade847596 ("keys: Provide KEYCTL_GRANT_PERMISSION")
    2e12256b9a76 ("keys: Replace uid/gid/perm permissions checking with an ACL")

    that the merge brought in).

    It turns out that it breaks booting with an encrypted volume, and Eric
    biggers reports that it also breaks the fscrypt tests [1] and loading of
    in-kernel X.509 certificates [2].

    The root cause of all the breakage is likely the same, but David Howells
    is off email so rather than try to work it out it's getting reverted in
    order to not impact the rest of the merge window.

    [1] https://lore.kernel.org/lkml/20190710011559.GA7973@sol.localdomain/
    [2] https://lore.kernel.org/lkml/20190710013225.GB7973@sol.localdomain/

    Link: https://lore.kernel.org/lkml/CAHk-=wjxoeMJfeBahnWH=9zShKp2bsVy527vo3_y8HfOdhwAAw@mail.gmail.com/
    Reported-by: Eric Biggers <ebiggers@kernel.org>
    Cc: David Howells <dhowells@redhat.com>
    Cc: James Morris <jmorris@namei.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

    Linus Torvalds
     

28 Jun, 2019

1 commit

  • Replace the uid/gid/perm permissions checking on a key with an ACL to allow
    the SETATTR and SEARCH permissions to be split. This will also allow a
    greater range of subjects to represented.

    ============
    WHY DO THIS?
    ============

    The problem is that SETATTR and SEARCH cover a slew of actions, not all of
    which should be grouped together.

    For SETATTR, this includes actions that are about controlling access to a
    key:

    (1) Changing a key's ownership.

    (2) Changing a key's security information.

    (3) Setting a keyring's restriction.

    And actions that are about managing a key's lifetime:

    (4) Setting an expiry time.

    (5) Revoking a key.

    and (proposed) managing a key as part of a cache:

    (6) Invalidating a key.

    Managing a key's lifetime doesn't really have anything to do with
    controlling access to that key.

    Expiry time is awkward since it's more about the lifetime of the content
    and so, in some ways goes better with WRITE permission. It can, however,
    be set unconditionally by a process with an appropriate authorisation token
    for instantiating a key, and can also be set by the key type driver when a
    key is instantiated, so lumping it with the access-controlling actions is
    probably okay.

    As for SEARCH permission, that currently covers:

    (1) Finding keys in a keyring tree during a search.

    (2) Permitting keyrings to be joined.

    (3) Invalidation.

    But these don't really belong together either, since these actions really
    need to be controlled separately.

    Finally, there are number of special cases to do with granting the
    administrator special rights to invalidate or clear keys that I would like
    to handle with the ACL rather than key flags and special checks.

    ===============
    WHAT IS CHANGED
    ===============

    The SETATTR permission is split to create two new permissions:

    (1) SET_SECURITY - which allows the key's owner, group and ACL to be
    changed and a restriction to be placed on a keyring.

    (2) REVOKE - which allows a key to be revoked.

    The SEARCH permission is split to create:

    (1) SEARCH - which allows a keyring to be search and a key to be found.

    (2) JOIN - which allows a keyring to be joined as a session keyring.

    (3) INVAL - which allows a key to be invalidated.

    The WRITE permission is also split to create:

    (1) WRITE - which allows a key's content to be altered and links to be
    added, removed and replaced in a keyring.

    (2) CLEAR - which allows a keyring to be cleared completely. This is
    split out to make it possible to give just this to an administrator.

    (3) REVOKE - see above.

    Keys acquire ACLs which consist of a series of ACEs, and all that apply are
    unioned together. An ACE specifies a subject, such as:

    (*) Possessor - permitted to anyone who 'possesses' a key
    (*) Owner - permitted to the key owner
    (*) Group - permitted to the key group
    (*) Everyone - permitted to everyone

    Note that 'Other' has been replaced with 'Everyone' on the assumption that
    you wouldn't grant a permit to 'Other' that you wouldn't also grant to
    everyone else.

    Further subjects may be made available by later patches.

    The ACE also specifies a permissions mask. The set of permissions is now:

    VIEW Can view the key metadata
    READ Can read the key content
    WRITE Can update/modify the key content
    SEARCH Can find the key by searching/requesting
    LINK Can make a link to the key
    SET_SECURITY Can change owner, ACL, expiry
    INVAL Can invalidate
    REVOKE Can revoke
    JOIN Can join this keyring
    CLEAR Can clear this keyring

    The KEYCTL_SETPERM function is then deprecated.

    The KEYCTL_SET_TIMEOUT function then is permitted if SET_SECURITY is set,
    or if the caller has a valid instantiation auth token.

    The KEYCTL_INVALIDATE function then requires INVAL.

    The KEYCTL_REVOKE function then requires REVOKE.

    The KEYCTL_JOIN_SESSION_KEYRING function then requires JOIN to join an
    existing keyring.

    The JOIN permission is enabled by default for session keyrings and manually
    created keyrings only.

    ======================
    BACKWARD COMPATIBILITY
    ======================

    To maintain backward compatibility, KEYCTL_SETPERM will translate the
    permissions mask it is given into a new ACL for a key - unless
    KEYCTL_SET_ACL has been called on that key, in which case an error will be
    returned.

    It will convert possessor, owner, group and other permissions into separate
    ACEs, if each portion of the mask is non-zero.

    SETATTR permission turns on all of INVAL, REVOKE and SET_SECURITY. WRITE
    permission turns on WRITE, REVOKE and, if a keyring, CLEAR. JOIN is turned
    on if a keyring is being altered.

    The KEYCTL_DESCRIBE function translates the ACL back into a permissions
    mask to return depending on possessor, owner, group and everyone ACEs.

    It will make the following mappings:

    (1) INVAL, JOIN -> SEARCH

    (2) SET_SECURITY -> SETATTR

    (3) REVOKE -> WRITE if SETATTR isn't already set

    (4) CLEAR -> WRITE

    Note that the value subsequently returned by KEYCTL_DESCRIBE may not match
    the value set with KEYCTL_SETATTR.

    =======
    TESTING
    =======

    This passes the keyutils testsuite for all but a couple of tests:

    (1) tests/keyctl/dh_compute/badargs: The first wrong-key-type test now
    returns EOPNOTSUPP rather than ENOKEY as READ permission isn't removed
    if the type doesn't have ->read(). You still can't actually read the
    key.

    (2) tests/keyctl/permitting/valid: The view-other-permissions test doesn't
    work as Other has been replaced with Everyone in the ACL.

    Signed-off-by: David Howells

    David Howells
     

03 May, 2019

1 commit


27 Apr, 2019

1 commit

  • …inux/kernel/git/jberg/mac80211-next

    Johannes Berg says:

    ====================
    Various updates, notably:
    * extended key ID support (from 802.11-2016)
    * per-STA TX power control support
    * mac80211 TX performance improvements
    * HE (802.11ax) updates
    * mesh link probing support
    * enhancements of multi-BSSID support (also related to HE)
    * OWE userspace processing support
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     

26 Apr, 2019

1 commit

  • One of the more common cases of allocation size calculations is finding
    the size of a structure that has a zero-sized array at the end, along
    with memory for some number of elements for that array. For example:

    struct foo {
    int stuff;
    struct boo entry[];
    };

    size = sizeof(struct foo) + count * sizeof(struct boo);
    instance = kzalloc(size, GFP_KERNEL)

    Instead of leaving these open-coded and prone to type mistakes, we can
    now use the new struct_size() helper:

    instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL)

    Notice that, in this case, variable size_of_regd is not necessary,
    hence it is removed.

    This code was detected with the help of Coccinelle.

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: Johannes Berg

    Gustavo A. R. Silva
     

23 Apr, 2019

1 commit

  • Commit c82c06ce43d3("cfg80211: Notify all User Hints To self managed wiphys")
    notified all new user hints to self managed wiphy's after device registration.
    But it didn't do this for anything other than cell base hints done before
    registration.

    This needs to be done during wiphy registration of a self managed device also,
    so that the previous user settings are retained.

    Fixes: c82c06ce43d3 ("cfg80211: Notify all User Hints To self managed wiphys")
    Signed-off-by: Sriram R
    Signed-off-by: Johannes Berg

    Sriram R
     

29 Mar, 2019

1 commit


11 Feb, 2019

1 commit

  • Jouni reports that in some cases it is possible that getting
    disconnected (or stopping AP, after previous patches) results
    in further operations hitting the window within the regulatory
    core restoring the regdomain to the defaults. The reason for
    this is that we have to call out to CRDA or otherwise do some
    asynchronous work, and thus can't do the restore atomically.

    However, we've previously seen all the data we need to do the
    restore, so we can hang on to that data and use it later for
    the restore. This makes the whole thing happen within a single
    locked section and thus atomic.

    However, we can't *always* do this - there are unfortunately
    cases where the restore needs to re-request, because this is
    also used (abused?) as an error recovery process, so make the
    new behaviour optional and only use it when doing a regular
    restore as described above.

    Reported-by: Jouni Malinen
    Signed-off-by: Johannes Berg

    Johannes Berg
     

01 Feb, 2019

1 commit


25 Jan, 2019

3 commits

  • Currently Self Managed WIPHY's are not notified on any
    hints other than user cell base station hints.
    Self Managed wiphy's basically rely on hints from firmware
    and its local regdb for regulatory management, so hints from wireless
    core can be ignored. But all user hints needs to be notified
    to them to provide flexibility to these drivers to honour or
    ignore these user hints.

    Currently none of the drivers supporting self managed wiphy
    register a notifier with cfg80211. Hence this change does not affect
    any other driver behavior.

    Signed-off-by: Sriram R
    Signed-off-by: Johannes Berg

    Sriram R
     
  • Recently, DMG frequency bands have been extended till 71GHz, so extend
    the range check till 20GHz (45-71GHZ), else some channels will be marked
    as disabled.

    Signed-off-by: Chaitanya Tata
    Signed-off-by: Johannes Berg

    Chaitanya Tata
     
  • If there are simulatenous queries of regdb, then there might be a case
    where multiple queries can trigger request_firmware_no_wait and can have
    parallel callbacks being executed asynchronously. In this scenario we
    might hit the WARN_ON.

    So remove the warn_on, as the code already handles multiple callbacks
    gracefully.

    Signed-off-by: Chaitanya Tata
    Signed-off-by: Johannes Berg

    Chaitanya Tata
     

08 Oct, 2018

1 commit


07 Oct, 2018

1 commit


04 Oct, 2018

1 commit


02 Oct, 2018

1 commit

  • Since my change to split out the regulatory init to occur later,
    any issues during earlier cfg80211_init() or errors during the
    platform device allocation would lead to crashes later. Make this
    more robust by checking that the earlier initialization succeeded.

    Fixes: d7be102f2945 ("cfg80211: initialize regulatory keys/database later")
    Signed-off-by: Johannes Berg

    Johannes Berg
     

01 Oct, 2018

1 commit

  • reg_process_hint_country_ie() can free regulatory_request and return
    REG_REQ_ALREADY_SET. We shouldn't use regulatory_request after it's
    called. KASAN error was observed when this happens.

    BUG: KASAN: use-after-free in reg_process_hint+0x839/0x8aa [cfg80211]
    Read of size 4 at addr ffff8800c430d434 by task kworker/1:3/89

    Workqueue: events reg_todo [cfg80211]
    Call Trace:
    dump_stack+0xc1/0x10c
    ? _atomic_dec_and_lock+0x1ad/0x1ad
    ? _raw_spin_lock_irqsave+0xa0/0xd2
    print_address_description+0x86/0x26f
    ? reg_process_hint+0x839/0x8aa [cfg80211]
    kasan_report+0x241/0x29b
    reg_process_hint+0x839/0x8aa [cfg80211]
    reg_todo+0x204/0x5b9 [cfg80211]
    process_one_work+0x55f/0x8d0
    ? worker_detach_from_pool+0x1b5/0x1b5
    ? _raw_spin_unlock_irq+0x65/0xdd
    ? _raw_spin_unlock_irqrestore+0xf3/0xf3
    worker_thread+0x5dd/0x841
    ? kthread_parkme+0x1d/0x1d
    kthread+0x270/0x285
    ? pr_cont_work+0xe3/0xe3
    ? rcu_read_unlock_sched_notrace+0xca/0xca
    ret_from_fork+0x22/0x40

    Allocated by task 2718:
    set_track+0x63/0xfa
    __kmalloc+0x119/0x1ac
    regulatory_hint_country_ie+0x38/0x329 [cfg80211]
    __cfg80211_connect_result+0x854/0xadd [cfg80211]
    cfg80211_rx_assoc_resp+0x3bc/0x4f0 [cfg80211]
    smsc95xx v1.0.6
    ieee80211_sta_rx_queued_mgmt+0x1803/0x7ed5 [mac80211]
    ieee80211_iface_work+0x411/0x696 [mac80211]
    process_one_work+0x55f/0x8d0
    worker_thread+0x5dd/0x841
    kthread+0x270/0x285
    ret_from_fork+0x22/0x40

    Freed by task 89:
    set_track+0x63/0xfa
    kasan_slab_free+0x6a/0x87
    kfree+0xdc/0x470
    reg_process_hint+0x31e/0x8aa [cfg80211]
    reg_todo+0x204/0x5b9 [cfg80211]
    process_one_work+0x55f/0x8d0
    worker_thread+0x5dd/0x841
    kthread+0x270/0x285
    ret_from_fork+0x22/0x40

    Signed-off-by: Yu Zhao
    Signed-off-by: Johannes Berg

    Yu Zhao
     

05 Sep, 2018

2 commits