SBC_builder/patch/kernel/sunxi-6.16/patches.megous/wifi-rtw89-Fix-inadverent-sharing-of-struct-ieee80211_supported.patch
2025-08-27 10:16:25 +02:00

121 lines
4.2 KiB
Diff

From d1df57a3a54fe840db56edd130991be84752957d Mon Sep 17 00:00:00 2001
From: Ondrej Jirman <megi@xff.cz>
Date: Sun, 27 Apr 2025 02:20:36 +0200
Subject: wifi: rtw89: Fix inadverent sharing of struct
ieee80211_supported_band data
Internally wiphy writes to individual channels in this structure,
so we must not share one static definition of channel list between
multiple device instances, because that causes hard to debug
breakage.
For example, with two rtw89 driven devices in the system, channel
information may get incoherent, preventing channel use.
Signed-off-by: Ondrej Jirman <megi@xff.cz>
---
drivers/net/wireless/realtek/rtw89/core.c | 51 ++++++++++++++++++-----
1 file changed, 41 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index cc9b014457ac..3455082f5e21 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -4398,16 +4398,47 @@ static void rtw89_init_he_eht_cap(struct rtw89_dev *rtwdev,
_ieee80211_set_sband_iftype_data(sband, iftype_data, idx);
}
+static struct ieee80211_supported_band *rtw89_copy_sband(const struct ieee80211_supported_band *sband)
+{
+ struct ieee80211_supported_band *copy = kmemdup(sband, sizeof(*sband), GFP_KERNEL);
+
+ if (!copy)
+ return NULL;
+
+ copy->channels = kmemdup(sband->channels, sizeof(struct ieee80211_channel) * sband->n_channels, GFP_KERNEL);
+ if (!copy->channels) {
+ kfree(copy);
+ return NULL;
+ }
+
+ copy->bitrates = kmemdup(sband->bitrates, sizeof(struct ieee80211_rate) * sband->n_bitrates, GFP_KERNEL);
+ if (!copy->bitrates) {
+ kfree(copy->channels);
+ kfree(copy);
+ return NULL;
+ }
+
+ return copy;
+}
+
+static void rtw89_free_sband(const struct ieee80211_supported_band *sband)
+{
+ if (sband) {
+ kfree(sband->bitrates);
+ kfree(sband->channels);
+ kfree(sband);
+ }
+}
+
static int rtw89_core_set_supported_band(struct rtw89_dev *rtwdev)
{
struct ieee80211_hw *hw = rtwdev->hw;
struct ieee80211_supported_band *sband_2ghz = NULL, *sband_5ghz = NULL;
struct ieee80211_supported_band *sband_6ghz = NULL;
- u32 size = sizeof(struct ieee80211_supported_band);
u8 support_bands = rtwdev->chip->support_bands;
if (support_bands & BIT(NL80211_BAND_2GHZ)) {
- sband_2ghz = kmemdup(&rtw89_sband_2ghz, size, GFP_KERNEL);
+ sband_2ghz = rtw89_copy_sband(&rtw89_sband_2ghz);
if (!sband_2ghz)
goto err;
rtw89_init_ht_cap(rtwdev, &sband_2ghz->ht_cap);
@@ -4416,7 +4447,7 @@ static int rtw89_core_set_supported_band(struct rtw89_dev *rtwdev)
}
if (support_bands & BIT(NL80211_BAND_5GHZ)) {
- sband_5ghz = kmemdup(&rtw89_sband_5ghz, size, GFP_KERNEL);
+ sband_5ghz = rtw89_copy_sband(&rtw89_sband_5ghz);
if (!sband_5ghz)
goto err;
rtw89_init_ht_cap(rtwdev, &sband_5ghz->ht_cap);
@@ -4426,7 +4457,7 @@ static int rtw89_core_set_supported_band(struct rtw89_dev *rtwdev)
}
if (support_bands & BIT(NL80211_BAND_6GHZ)) {
- sband_6ghz = kmemdup(&rtw89_sband_6ghz, size, GFP_KERNEL);
+ sband_6ghz = rtw89_copy_sband(&rtw89_sband_6ghz);
if (!sband_6ghz)
goto err;
rtw89_init_he_eht_cap(rtwdev, NL80211_BAND_6GHZ, sband_6ghz);
@@ -4445,9 +4476,9 @@ static int rtw89_core_set_supported_band(struct rtw89_dev *rtwdev)
kfree((__force void *)sband_5ghz->iftype_data);
if (sband_6ghz)
kfree((__force void *)sband_6ghz->iftype_data);
- kfree(sband_2ghz);
- kfree(sband_5ghz);
- kfree(sband_6ghz);
+ rtw89_free_sband(sband_2ghz);
+ rtw89_free_sband(sband_5ghz);
+ rtw89_free_sband(sband_6ghz);
return -ENOMEM;
}
@@ -4461,9 +4492,9 @@ static void rtw89_core_clr_supported_band(struct rtw89_dev *rtwdev)
kfree((__force void *)hw->wiphy->bands[NL80211_BAND_5GHZ]->iftype_data);
if (hw->wiphy->bands[NL80211_BAND_6GHZ])
kfree((__force void *)hw->wiphy->bands[NL80211_BAND_6GHZ]->iftype_data);
- kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]);
- kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]);
- kfree(hw->wiphy->bands[NL80211_BAND_6GHZ]);
+ rtw89_free_sband(hw->wiphy->bands[NL80211_BAND_2GHZ]);
+ rtw89_free_sband(hw->wiphy->bands[NL80211_BAND_5GHZ]);
+ rtw89_free_sband(hw->wiphy->bands[NL80211_BAND_6GHZ]);
hw->wiphy->bands[NL80211_BAND_2GHZ] = NULL;
hw->wiphy->bands[NL80211_BAND_5GHZ] = NULL;
hw->wiphy->bands[NL80211_BAND_6GHZ] = NULL;
--
2.35.3