From: Greg Kroah-Hartman Date: Wed, 6 Nov 2024 07:23:07 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v4.19.323~36 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7bc35de69ff2905a6002d42f7fc2515454eac65a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch --- diff --git a/queue-6.1/series b/queue-6.1/series index fd692071841..28bd0f76786 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -115,3 +115,4 @@ io_uring-always-lock-__io_cqring_overflow_flush.patch x86-bugs-use-code-segment-selector-for-verw-operand.patch wifi-mac80211-fix-null-dereference-at-band-check-in-starting-tx-ba-session.patch nilfs2-fix-kernel-bug-due-to-missing-clearing-of-checked-flag.patch +wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch diff --git a/queue-6.1/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch b/queue-6.1/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch new file mode 100644 index 00000000000..ae614d0d251 --- /dev/null +++ b/queue-6.1/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch @@ -0,0 +1,46 @@ +From 7245012f0f496162dd95d888ed2ceb5a35170f1a Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 23 Oct 2024 09:17:44 +0200 +Subject: wifi: iwlwifi: mvm: fix 6 GHz scan construction + +From: Johannes Berg + +commit 7245012f0f496162dd95d888ed2ceb5a35170f1a upstream. + +If more than 255 colocated APs exist for the set of all +APs found during 2.4/5 GHz scanning, then the 6 GHz scan +construction will loop forever since the loop variable +has type u8, which can never reach the number found when +that's bigger than 255, and is stored in a u32 variable. +Also move it into the loops to have a smaller scope. + +Using a u32 there is fine, we limit the number of APs in +the scan list and each has a limit on the number of RNR +entries due to the frame size. With a limit of 1000 scan +results, a frame size upper bound of 4096 (really it's +more like ~2300) and a TBTT entry size of at least 11, +we get an upper bound for the number of ~372k, well in +the bounds of a u32. + +Cc: stable@vger.kernel.org +Fixes: eae94cf82d74 ("iwlwifi: mvm: add support for 6GHz") +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219375 +Link: https://patch.msgid.link/20241023091744.f4baed5c08a1.I8b417148bbc8c5d11c101e1b8f5bf372e17bf2a7@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -1739,7 +1739,8 @@ iwl_mvm_umac_scan_cfg_channels_v6_6g(str + &cp->channel_config[ch_cnt]; + + u32 s_ssid_bitmap = 0, bssid_bitmap = 0, flags = 0; +- u8 j, k, s_max = 0, b_max = 0, n_used_bssid_entries; ++ u8 k, s_max = 0, b_max = 0, n_used_bssid_entries; ++ u32 j; + bool force_passive, found = false, allow_passive = true, + unsolicited_probe_on_chan = false, psc_no_listen = false; +