6.1-stable patches

added patches:
	wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch

diff --git a/queue-6.1/series b/queue-6.1/series
index fd6920718417470d123ff99627dcd76d978e339d..28bd0f767867734bd6ca214979af931ea8be8679 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -115,3 +115,4 @@ io_uring-always-lock-__io_cqring_overflow_flush.patch
 x86-bugs-use-code-segment-selector-for-verw-operand.patch
 wifi-mac80211-fix-null-dereference-at-band-check-in-starting-tx-ba-session.patch
 nilfs2-fix-kernel-bug-due-to-missing-clearing-of-checked-flag.patch
+wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch

diff --git a/queue-6.1/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch b/queue-6.1/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch
new file mode 100644 (file)
index 0000000..ae614d0
--- /dev/null
+++ b/queue-6.1/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch
@@ -0,0 +1,46 @@
+From 7245012f0f496162dd95d888ed2ceb5a35170f1a Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 23 Oct 2024 09:17:44 +0200
+Subject: wifi: iwlwifi: mvm: fix 6 GHz scan construction
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 7245012f0f496162dd95d888ed2ceb5a35170f1a upstream.
+
+If more than 255 colocated APs exist for the set of all
+APs found during 2.4/5 GHz scanning, then the 6 GHz scan
+construction will loop forever since the loop variable
+has type u8, which can never reach the number found when
+that's bigger than 255, and is stored in a u32 variable.
+Also move it into the loops to have a smaller scope.
+
+Using a u32 there is fine, we limit the number of APs in
+the scan list and each has a limit on the number of RNR
+entries due to the frame size. With a limit of 1000 scan
+results, a frame size upper bound of 4096 (really it's
+more like ~2300) and a TBTT entry size of at least 11,
+we get an upper bound for the number of ~372k, well in
+the bounds of a u32.
+
+Cc: stable@vger.kernel.org
+Fixes: eae94cf82d74 ("iwlwifi: mvm: add support for 6GHz")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219375
+Link: https://patch.msgid.link/20241023091744.f4baed5c08a1.I8b417148bbc8c5d11c101e1b8f5bf372e17bf2a7@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/scan.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+@@ -1739,7 +1739,8 @@ iwl_mvm_umac_scan_cfg_channels_v6_6g(str
+                       &cp->channel_config[ch_cnt];
+ 
+               u32 s_ssid_bitmap = 0, bssid_bitmap = 0, flags = 0;
+-              u8 j, k, s_max = 0, b_max = 0, n_used_bssid_entries;
++              u8 k, s_max = 0, b_max = 0, n_used_bssid_entries;
++              u32 j;
+               bool force_passive, found = false, allow_passive = true,
+                    unsolicited_probe_on_chan = false, psc_no_listen = false;
+