5.15-stable patches

added patches:
	wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch

diff --git a/queue-5.15/series b/queue-5.15/series
index 7d8477863c01b96af7410b5646cfebfb972ab539..2cc2b5b5e7719dd748a005d564cc3ef0362f4d22 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -65,3 +65,4 @@ mm-page_alloc-let-gfp_atomic-order-0-allocs-access-h.patch
 ocfs2-pass-u64-to-ocfs2_truncate_inline-maybe-overfl.patch
 x86-bugs-use-code-segment-selector-for-verw-operand.patch
 nilfs2-fix-kernel-bug-due-to-missing-clearing-of-checked-flag.patch
+wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch

diff --git a/queue-5.15/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch b/queue-5.15/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch
new file mode 100644 (file)
index 0000000..ef43482
--- /dev/null
+++ b/queue-5.15/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch
@@ -0,0 +1,46 @@
+From 7245012f0f496162dd95d888ed2ceb5a35170f1a Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 23 Oct 2024 09:17:44 +0200
+Subject: wifi: iwlwifi: mvm: fix 6 GHz scan construction
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 7245012f0f496162dd95d888ed2ceb5a35170f1a upstream.
+
+If more than 255 colocated APs exist for the set of all
+APs found during 2.4/5 GHz scanning, then the 6 GHz scan
+construction will loop forever since the loop variable
+has type u8, which can never reach the number found when
+that's bigger than 255, and is stored in a u32 variable.
+Also move it into the loops to have a smaller scope.
+
+Using a u32 there is fine, we limit the number of APs in
+the scan list and each has a limit on the number of RNR
+entries due to the frame size. With a limit of 1000 scan
+results, a frame size upper bound of 4096 (really it's
+more like ~2300) and a TBTT entry size of at least 11,
+we get an upper bound for the number of ~372k, well in
+the bounds of a u32.
+
+Cc: stable@vger.kernel.org
+Fixes: eae94cf82d74 ("iwlwifi: mvm: add support for 6GHz")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219375
+Link: https://patch.msgid.link/20241023091744.f4baed5c08a1.I8b417148bbc8c5d11c101e1b8f5bf372e17bf2a7@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/scan.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+@@ -1753,7 +1753,8 @@ iwl_mvm_umac_scan_cfg_channels_v6_6g(str
+                       &cp->channel_config[i];
+ 
+               u32 s_ssid_bitmap = 0, bssid_bitmap = 0, flags = 0;
+-              u8 j, k, s_max = 0, b_max = 0, n_used_bssid_entries;
++              u8 k, s_max = 0, b_max = 0, n_used_bssid_entries;
++              u32 j;
+               bool force_passive, found = false, allow_passive = true,
+                    unsolicited_probe_on_chan = false, psc_no_listen = false;
+