From a68c21fa37d931ff78c5dd80698db0994098af18 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 6 Nov 2024 08:22:58 +0100 Subject: [PATCH] 5.15-stable patches added patches: wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch --- queue-5.15/series | 1 + ...wifi-mvm-fix-6-ghz-scan-construction.patch | 46 +++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 queue-5.15/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch diff --git a/queue-5.15/series b/queue-5.15/series index 7d8477863c0..2cc2b5b5e77 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -65,3 +65,4 @@ mm-page_alloc-let-gfp_atomic-order-0-allocs-access-h.patch ocfs2-pass-u64-to-ocfs2_truncate_inline-maybe-overfl.patch x86-bugs-use-code-segment-selector-for-verw-operand.patch nilfs2-fix-kernel-bug-due-to-missing-clearing-of-checked-flag.patch +wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch diff --git a/queue-5.15/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch b/queue-5.15/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch new file mode 100644 index 00000000000..ef43482856a --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-mvm-fix-6-ghz-scan-construction.patch @@ -0,0 +1,46 @@ +From 7245012f0f496162dd95d888ed2ceb5a35170f1a Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 23 Oct 2024 09:17:44 +0200 +Subject: wifi: iwlwifi: mvm: fix 6 GHz scan construction + +From: Johannes Berg + +commit 7245012f0f496162dd95d888ed2ceb5a35170f1a upstream. + +If more than 255 colocated APs exist for the set of all +APs found during 2.4/5 GHz scanning, then the 6 GHz scan +construction will loop forever since the loop variable +has type u8, which can never reach the number found when +that's bigger than 255, and is stored in a u32 variable. +Also move it into the loops to have a smaller scope. + +Using a u32 there is fine, we limit the number of APs in +the scan list and each has a limit on the number of RNR +entries due to the frame size. With a limit of 1000 scan +results, a frame size upper bound of 4096 (really it's +more like ~2300) and a TBTT entry size of at least 11, +we get an upper bound for the number of ~372k, well in +the bounds of a u32. + +Cc: stable@vger.kernel.org +Fixes: eae94cf82d74 ("iwlwifi: mvm: add support for 6GHz") +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219375 +Link: https://patch.msgid.link/20241023091744.f4baed5c08a1.I8b417148bbc8c5d11c101e1b8f5bf372e17bf2a7@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -1753,7 +1753,8 @@ iwl_mvm_umac_scan_cfg_channels_v6_6g(str + &cp->channel_config[i]; + + u32 s_ssid_bitmap = 0, bssid_bitmap = 0, flags = 0; +- u8 j, k, s_max = 0, b_max = 0, n_used_bssid_entries; ++ u8 k, s_max = 0, b_max = 0, n_used_bssid_entries; ++ u32 j; + bool force_passive, found = false, allow_passive = true, + unsolicited_probe_on_chan = false, psc_no_listen = false; + -- 2.47.3