[PATCH for-6.2 0/3] wifi: brcmfmac: regression fixes

[PATCH for-6.2 0/3] wifi: brcmfmac: regression fixes

[Arend van Spriel]

[-- Attachment #1: Type: text/plain, Size: 884 bytes --]

Stefan Wahren reported a minor issue where the kernel log was filled
with error messages at regular interval. This happens in new functionality
added in 6.2 merge window. Found a potential NULL-deref which will happen
when device does not have 5GHz band. The last patch is really a cosmetic
one for wireless-next, but I added it here for reference. I can resend that
later when the other patches are distributed into wireless-next whenever that
happens.

This series applies to the main branch of the wireless repository.

Arend van Spriel (3):
  wifi: brcmfmac: avoid handling disabled channels for survey dump
  wifi: brcmfmac: avoid NULL-deref in survey dump for 2G only device
  wifi: brcmfmac: change cfg80211_set_channel() name and signature

 .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 42 +++++++++----------
 1 file changed, 20 insertions(+), 22 deletions(-)

--
2.32.0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

[PATCH for-6.2 1/3] wifi: brcmfmac: avoid handling disabled channels for survey dump

[Arend van Spriel]

[-- Attachment #1: Type: text/plain, Size: 4425 bytes --]

An issue was reported in which periodically error messages are
printed in the kernel log:

[   26.303445] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
[   26.303554] brcmfmac mmc1:0001:1: Direct firmware load for brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.bin failed with error -2
[   26.516752] brcmfmac_wcc: brcmf_wcc_attach: executing
[   26.528264] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Jan  4 2021 19:56:29 version 7.45.229 (617f1f5 CY) FWID 01-2dbd9d2e
[   27.076829] Bluetooth: hci0: BCM: features 0x2f
[   27.078592] Bluetooth: hci0: BCM43455 37.4MHz Raspberry Pi 3+
[   27.078601] Bluetooth: hci0: BCM4345C0 (003.001.025) build 0342
[   30.142104] Adding 102396k swap on /var/swap.  Priority:-2 extents:1 across:102396k SS
[   30.590017] Bluetooth: MGMT ver 1.22
[  104.897615] brcmfmac: cfg80211_set_channel: set chanspec 0x100e fail, reason -52
[  104.897992] brcmfmac: cfg80211_set_channel: set chanspec 0xd022 fail, reason -52
[  105.007672] brcmfmac: cfg80211_set_channel: set chanspec 0xd026 fail, reason -52
[  105.117654] brcmfmac: cfg80211_set_channel: set chanspec 0xd02a fail, reason -52
[  105.227636] brcmfmac: cfg80211_set_channel: set chanspec 0xd02e fail, reason -52
[  106.987552] brcmfmac: cfg80211_set_channel: set chanspec 0xd090 fail, reason -52
[  106.987911] brcmfmac: cfg80211_set_channel: set chanspec 0xd095 fail, reason -52
[  106.988233] brcmfmac: cfg80211_set_channel: set chanspec 0xd099 fail, reason -52
[  106.988565] brcmfmac: cfg80211_set_channel: set chanspec 0xd09d fail, reason -52
[  106.988909] brcmfmac: cfg80211_set_channel: set chanspec 0xd0a1 fail, reason -52

This happens in brcmf_cfg80211_dump_survey() because we try a disabled
channel. When channel is marked as disabled we do not need to fill any
other info so bail out.

Fixes: 6c04deae1438 ("brcmfmac: Add dump_survey cfg80211 ops for HostApd AutoChannelSelection")
Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c       | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index bff3128c2f26..478ca3848c64 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -7937,6 +7937,9 @@ cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 
+	if (chan->flags & IEEE80211_CHAN_DISABLED)
+		return -EINVAL;
+
 	/* set_channel */
 	chspec = channel_to_chanspec(&cfg->d11inf, chan);
 	if (chspec != INVCHANSPEC) {
@@ -7961,7 +7964,6 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 	struct brcmf_dump_survey survey = {};
 	struct ieee80211_supported_band *band;
-	struct ieee80211_channel *chan;
 	struct cca_msrmnt_query req;
 	u32 noise;
 	int err;
@@ -7987,13 +7989,10 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
 	}
 
 	/* Setting current channel to the requested channel */
-	chan = &band->channels[idx];
-	err = cfg80211_set_channel(wiphy, ndev, chan, NL80211_CHAN_HT20);
-	if (err) {
-		info->channel = chan;
-		info->filled = 0;
+	info->filled = 0;
+	info->channel = &band->channels[idx];
+	if (cfg80211_set_channel(wiphy, ndev, info->channel, NL80211_CHAN_HT20))
 		return 0;
-	}
 
 	/* Disable mpc */
 	brcmf_set_mpc(ifp, 0);
@@ -8028,7 +8027,6 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
 	if (err)
 		goto exit;
 
-	info->channel = chan;
 	info->noise = noise;
 	info->time = ACS_MSRMNT_DELAY;
 	info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
@@ -8040,7 +8038,7 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
 		SURVEY_INFO_TIME_TX;
 
 	brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
-		  ieee80211_frequency_to_channel(chan->center_freq),
+		  ieee80211_frequency_to_channel(info->channel->center_freq),
 		  ACS_MSRMNT_DELAY);
 	brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
 		  info->noise, info->time_busy, info->time_rx, info->time_tx);
-- 
2.32.0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

Re: [PATCH for-6.2 1/3] wifi: brcmfmac: avoid handling disabled channels for survey dump

[Stefan Wahren]

Hi Arend,
hi Kalle,

Am 03.01.23 um 13:41 schrieb Arend van Spriel:
> An issue was reported in which periodically error messages are
> printed in the kernel log:
>
> [   26.303445] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
> [   26.303554] brcmfmac mmc1:0001:1: Direct firmware load for brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.bin failed with error -2
> [   26.516752] brcmfmac_wcc: brcmf_wcc_attach: executing
regardless of this patch the commit d6a5c562214f ("wifi: brcmfmac: add 
support for vendor-specific firmware api") introduced this error message 
wcc/core.c, but i guess this should be trace or info message?
> [   26.528264] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Jan  4 2021 19:56:29 version 7.45.229 (617f1f5 CY) FWID 01-2dbd9d2e
> [   27.076829] Bluetooth: hci0: BCM: features 0x2f
> [   27.078592] Bluetooth: hci0: BCM43455 37.4MHz Raspberry Pi 3+
> [   27.078601] Bluetooth: hci0: BCM4345C0 (003.001.025) build 0342
> [   30.142104] Adding 102396k swap on /var/swap.  Priority:-2 extents:1 across:102396k SS
> [   30.590017] Bluetooth: MGMT ver 1.22
> [  104.897615] brcmfmac: cfg80211_set_channel: set chanspec 0x100e fail, reason -52
> [  104.897992] brcmfmac: cfg80211_set_channel: set chanspec 0xd022 fail, reason -52
> [  105.007672] brcmfmac: cfg80211_set_channel: set chanspec 0xd026 fail, reason -52
> [  105.117654] brcmfmac: cfg80211_set_channel: set chanspec 0xd02a fail, reason -52
> [  105.227636] brcmfmac: cfg80211_set_channel: set chanspec 0xd02e fail, reason -52
> [  106.987552] brcmfmac: cfg80211_set_channel: set chanspec 0xd090 fail, reason -52
> [  106.987911] brcmfmac: cfg80211_set_channel: set chanspec 0xd095 fail, reason -52
> [  106.988233] brcmfmac: cfg80211_set_channel: set chanspec 0xd099 fail, reason -52
> [  106.988565] brcmfmac: cfg80211_set_channel: set chanspec 0xd09d fail, reason -52
> [  106.988909] brcmfmac: cfg80211_set_channel: set chanspec 0xd0a1 fail, reason -52
>
> This happens in brcmf_cfg80211_dump_survey() because we try a disabled
> channel. When channel is marked as disabled we do not need to fill any
> other info so bail out.
>
> Fixes: 6c04deae1438 ("brcmfmac: Add dump_survey cfg80211 ops for HostApd AutoChannelSelection")
> Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>

this patch is:

Tested-by: Stefan Wahren <stefan.wahren@i2se.com>

Thanks
> ---
>   .../broadcom/brcm80211/brcmfmac/cfg80211.c       | 16 +++++++---------
>   1 file changed, 7 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> index bff3128c2f26..478ca3848c64 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> @@ -7937,6 +7937,9 @@ cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
>   	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
>   	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
>   
> +	if (chan->flags & IEEE80211_CHAN_DISABLED)
> +		return -EINVAL;
> +
>   	/* set_channel */
>   	chspec = channel_to_chanspec(&cfg->d11inf, chan);
>   	if (chspec != INVCHANSPEC) {
> @@ -7961,7 +7964,6 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
>   	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
>   	struct brcmf_dump_survey survey = {};
>   	struct ieee80211_supported_band *band;
> -	struct ieee80211_channel *chan;
>   	struct cca_msrmnt_query req;
>   	u32 noise;
>   	int err;
> @@ -7987,13 +7989,10 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
>   	}
>   
>   	/* Setting current channel to the requested channel */
> -	chan = &band->channels[idx];
> -	err = cfg80211_set_channel(wiphy, ndev, chan, NL80211_CHAN_HT20);
> -	if (err) {
> -		info->channel = chan;
> -		info->filled = 0;
> +	info->filled = 0;
> +	info->channel = &band->channels[idx];
> +	if (cfg80211_set_channel(wiphy, ndev, info->channel, NL80211_CHAN_HT20))
>   		return 0;
> -	}
>   
>   	/* Disable mpc */
>   	brcmf_set_mpc(ifp, 0);
> @@ -8028,7 +8027,6 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
>   	if (err)
>   		goto exit;
>   
> -	info->channel = chan;
>   	info->noise = noise;
>   	info->time = ACS_MSRMNT_DELAY;
>   	info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
> @@ -8040,7 +8038,7 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
>   		SURVEY_INFO_TIME_TX;
>   
>   	brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
> -		  ieee80211_frequency_to_channel(chan->center_freq),
> +		  ieee80211_frequency_to_channel(info->channel->center_freq),
>   		  ACS_MSRMNT_DELAY);
>   	brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
>   		  info->noise, info->time_busy, info->time_rx, info->time_tx);

Re: [PATCH for-6.2 1/3] wifi: brcmfmac: avoid handling disabled channels for survey dump

[Arend van Spriel]

[-- Attachment #1: Type: text/plain, Size: 4483 bytes --]

On 1/3/2023 8:15 PM, Stefan Wahren wrote:
> Hi Arend,
> hi Kalle,
> 
> Am 03.01.23 um 13:41 schrieb Arend van Spriel:
>> An issue was reported in which periodically error messages are
>> printed in the kernel log:
>>
>> [   26.303445] brcmfmac: brcmf_fw_alloc_request: using 
>> brcm/brcmfmac43455-sdio for chip BCM4345/6
>> [   26.303554] brcmfmac mmc1:0001:1: Direct firmware load for 
>> brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.bin failed with 
>> error -2
>> [   26.516752] brcmfmac_wcc: brcmf_wcc_attach: executing
> regardless of this patch the commit d6a5c562214f ("wifi: brcmfmac: add 
> support for vendor-specific firmware api") introduced this error message 
> wcc/core.c, but i guess this should be trace or info message?

Ah, yes. I will change that for the next release. Thanks for pointing at 
that.

>> [   26.528264] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 
>> wl0: Jan  4 2021 19:56:29 version 7.45.229 (617f1f5 CY) FWID 01-2dbd9d2e
>> [   27.076829] Bluetooth: hci0: BCM: features 0x2f
>> [   27.078592] Bluetooth: hci0: BCM43455 37.4MHz Raspberry Pi 3+
>> [   27.078601] Bluetooth: hci0: BCM4345C0 (003.001.025) build 0342

[...]

>> Fixes: 6c04deae1438 ("brcmfmac: Add dump_survey cfg80211 ops for 
>> HostApd AutoChannelSelection")
>> Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
>> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> 
> this patch is:
> 
> Tested-by: Stefan Wahren <stefan.wahren@i2se.com>

Appreciated.

Regards,
Arend

> Thanks
>> ---
>>   .../broadcom/brcm80211/brcmfmac/cfg80211.c       | 16 +++++++---------
>>   1 file changed, 7 insertions(+), 9 deletions(-)
>>
>> diff --git 
>> a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
>> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
>> index bff3128c2f26..478ca3848c64 100644
>> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
>> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
>> @@ -7937,6 +7937,9 @@ cfg80211_set_channel(struct wiphy *wiphy, struct 
>> net_device *dev,
>>       struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
>>       struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
>> +    if (chan->flags & IEEE80211_CHAN_DISABLED)
>> +        return -EINVAL;
>> +
>>       /* set_channel */
>>       chspec = channel_to_chanspec(&cfg->d11inf, chan);
>>       if (chspec != INVCHANSPEC) {
>> @@ -7961,7 +7964,6 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, 
>> struct net_device *ndev,
>>       struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
>>       struct brcmf_dump_survey survey = {};
>>       struct ieee80211_supported_band *band;
>> -    struct ieee80211_channel *chan;
>>       struct cca_msrmnt_query req;
>>       u32 noise;
>>       int err;
>> @@ -7987,13 +7989,10 @@ brcmf_cfg80211_dump_survey(struct wiphy 
>> *wiphy, struct net_device *ndev,
>>       }
>>       /* Setting current channel to the requested channel */
>> -    chan = &band->channels[idx];
>> -    err = cfg80211_set_channel(wiphy, ndev, chan, NL80211_CHAN_HT20);
>> -    if (err) {
>> -        info->channel = chan;
>> -        info->filled = 0;
>> +    info->filled = 0;
>> +    info->channel = &band->channels[idx];
>> +    if (cfg80211_set_channel(wiphy, ndev, info->channel, 
>> NL80211_CHAN_HT20))
>>           return 0;
>> -    }
>>       /* Disable mpc */
>>       brcmf_set_mpc(ifp, 0);
>> @@ -8028,7 +8027,6 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, 
>> struct net_device *ndev,
>>       if (err)
>>           goto exit;
>> -    info->channel = chan;
>>       info->noise = noise;
>>       info->time = ACS_MSRMNT_DELAY;
>>       info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
>> @@ -8040,7 +8038,7 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, 
>> struct net_device *ndev,
>>           SURVEY_INFO_TIME_TX;
>>       brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
>> -          ieee80211_frequency_to_channel(chan->center_freq),
>> +          ieee80211_frequency_to_channel(info->channel->center_freq),
>>             ACS_MSRMNT_DELAY);
>>       brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
>>             info->noise, info->time_busy, info->time_rx, info->time_tx);

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

Re: [PATCH for-6.2 1/3] wifi: brcmfmac: avoid handling disabled channels for survey dump

[Kalle Valo]

Arend van Spriel <arend.vanspriel@broadcom.com> wrote:

> An issue was reported in which periodically error messages are
> printed in the kernel log:
> 
> [   26.303445] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
> [   26.303554] brcmfmac mmc1:0001:1: Direct firmware load for brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.bin failed with error -2
> [   26.516752] brcmfmac_wcc: brcmf_wcc_attach: executing
> [   26.528264] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Jan  4 2021 19:56:29 version 7.45.229 (617f1f5 CY) FWID 01-2dbd9d2e
> [   27.076829] Bluetooth: hci0: BCM: features 0x2f
> [   27.078592] Bluetooth: hci0: BCM43455 37.4MHz Raspberry Pi 3+
> [   27.078601] Bluetooth: hci0: BCM4345C0 (003.001.025) build 0342
> [   30.142104] Adding 102396k swap on /var/swap.  Priority:-2 extents:1 across:102396k SS
> [   30.590017] Bluetooth: MGMT ver 1.22
> [  104.897615] brcmfmac: cfg80211_set_channel: set chanspec 0x100e fail, reason -52
> [  104.897992] brcmfmac: cfg80211_set_channel: set chanspec 0xd022 fail, reason -52
> [  105.007672] brcmfmac: cfg80211_set_channel: set chanspec 0xd026 fail, reason -52
> [  105.117654] brcmfmac: cfg80211_set_channel: set chanspec 0xd02a fail, reason -52
> [  105.227636] brcmfmac: cfg80211_set_channel: set chanspec 0xd02e fail, reason -52
> [  106.987552] brcmfmac: cfg80211_set_channel: set chanspec 0xd090 fail, reason -52
> [  106.987911] brcmfmac: cfg80211_set_channel: set chanspec 0xd095 fail, reason -52
> [  106.988233] brcmfmac: cfg80211_set_channel: set chanspec 0xd099 fail, reason -52
> [  106.988565] brcmfmac: cfg80211_set_channel: set chanspec 0xd09d fail, reason -52
> [  106.988909] brcmfmac: cfg80211_set_channel: set chanspec 0xd0a1 fail, reason -52
> 
> This happens in brcmf_cfg80211_dump_survey() because we try a disabled
> channel. When channel is marked as disabled we do not need to fill any
> other info so bail out.
> 
> Fixes: 6c04deae1438 ("brcmfmac: Add dump_survey cfg80211 ops for HostApd AutoChannelSelection")
> Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> Tested-by: Stefan Wahren <stefan.wahren@i2se.com>

2 patches applied to wireless.git, thanks.

e5d1ab1a73ad wifi: brcmfmac: avoid handling disabled channels for survey dump
aadb50d15712 wifi: brcmfmac: avoid NULL-deref in survey dump for 2G only device

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20230103124117.271988-2-arend.vanspriel@broadcom.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

[PATCH for-6.2 2/3] wifi: brcmfmac: avoid NULL-deref in survey dump for 2G only device

[Arend van Spriel]

[-- Attachment #1: Type: text/plain, Size: 1979 bytes --]

When dealing with a device for 2GHz band only the wiphy->bands for
5GHz will be NULL. This would result in a NULL-deref in the
brcmf_cfg80211_dump_survey() function. Rework the code with a
for-loop to make it easier to add another band.

Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 478ca3848c64..b115902eb475 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -7964,6 +7964,7 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 	struct brcmf_dump_survey survey = {};
 	struct ieee80211_supported_band *band;
+	enum nl80211_band band_id;
 	struct cca_msrmnt_query req;
 	u32 noise;
 	int err;
@@ -7976,21 +7977,23 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
 		return -EBUSY;
 	}
 
-	band = wiphy->bands[NL80211_BAND_2GHZ];
-	if (band && idx >= band->n_channels) {
-		idx -= band->n_channels;
-		band = NULL;
-	}
+	for (band_id = 0; band_id < NUM_NL80211_BANDS; band_id++) {
+		band = wiphy->bands[band_id];
+		if (!band)
+			continue;
+		if (idx >= band->n_channels) {
+			idx -= band->n_channels;
+			continue;
+		}
 
-	if (!band || idx >= band->n_channels) {
-		band = wiphy->bands[NL80211_BAND_5GHZ];
-		if (idx >= band->n_channels)
-			return -ENOENT;
+		info->channel = &band->channels[idx];
+		break;
 	}
+	if (band_id == NUM_NL80211_BANDS)
+		return -ENOENT;
 
 	/* Setting current channel to the requested channel */
 	info->filled = 0;
-	info->channel = &band->channels[idx];
 	if (cfg80211_set_channel(wiphy, ndev, info->channel, NL80211_CHAN_HT20))
 		return 0;
 
-- 
2.32.0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

Re: [PATCH for-6.2 2/3] wifi: brcmfmac: avoid NULL-deref in survey dump for 2G only device

[Arend van Spriel]

[-- Attachment #1: Type: text/plain, Size: 616 bytes --]

On 1/3/2023 1:41 PM, Arend van Spriel wrote:
> When dealing with a device for 2GHz band only the wiphy->bands for
> 5GHz will be NULL. This would result in a NULL-deref in the
> brcmf_cfg80211_dump_survey() function. Rework the code with a
> for-loop to make it easier to add another band.

Forgot the Fixes tag here:

Fixes: 6c04deae1438 ("brcmfmac: Add dump_survey cfg80211 ops for HostApd 
AutoChannelSelection")
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> ---
>   .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 23 +++++++++++--------
>   1 file changed, 13 insertions(+), 10 deletions(-)

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

[PATCH for-6.2 3/3] wifi: brcmfmac: change cfg80211_set_channel() name and signature

[Arend van Spriel]

[-- Attachment #1: Type: text/plain, Size: 1578 bytes --]

The function cfg80211_set_channel() is an static function in brcmfmac
but the name is misleading. Hence rename it with 'brcmf' prefix. Also
changing the parameters to avoid additional conversions.

Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
 .../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c    | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index b115902eb475..a9690ec4c850 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -7928,13 +7928,10 @@ brcmf_dump_obss(struct brcmf_if *ifp, struct cca_msrmnt_query req,
 }
 
 static s32
-cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
-		     struct ieee80211_channel *chan,
-		     enum nl80211_channel_type channel_type)
+brcmf_set_channel(struct brcmf_cfg80211_info *cfg, struct ieee80211_channel *chan)
 {
 	u16 chspec = 0;
 	int err = 0;
-	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 
 	if (chan->flags & IEEE80211_CHAN_DISABLED)
@@ -7994,7 +7991,7 @@ brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
 
 	/* Setting current channel to the requested channel */
 	info->filled = 0;
-	if (cfg80211_set_channel(wiphy, ndev, info->channel, NL80211_CHAN_HT20))
+	if (brcmf_set_channel(cfg, info->channel))
 		return 0;
 
 	/* Disable mpc */
-- 
2.32.0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

Re: [PATCH for-6.2 3/3] wifi: brcmfmac: change cfg80211_set_channel() name and signature

[Kalle Valo]

Arend van Spriel <arend.vanspriel@broadcom.com> writes:

> The function cfg80211_set_channel() is an static function in brcmfmac
> but the name is misleading. Hence rename it with 'brcmf' prefix. Also
> changing the parameters to avoid additional conversions.
>
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>

If I understood correctly this patch 3 is for wireless-next. So adding a
reminder for myself to _not_ take this to wireless tree :)

(I wish patchwork would have a support for offline notes so I would not
need to send emails like this)

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH for-6.2 3/3] wifi: brcmfmac: change cfg80211_set_channel() name and signature

[Arend Van Spriel]

[-- Attachment #1: Type: text/plain, Size: 584 bytes --]

On January 9, 2023 4:51:03 PM Kalle Valo <kvalo@kernel.org> wrote:

> Arend van Spriel <arend.vanspriel@broadcom.com> writes:
>
>> The function cfg80211_set_channel() is an static function in brcmfmac
>> but the name is misleading. Hence rename it with 'brcmf' prefix. Also
>> changing the parameters to avoid additional conversions.
>>
>> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
>
> If I understood correctly this patch 3 is for wireless-next. So adding a
> reminder for myself to _not_ take this to wireless tree :)

FWIW you understood correctly.

Gr. AvS



[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4219 bytes --]

Re: [PATCH for-6.2 3/3] wifi: brcmfmac: change cfg80211_set_channel() name and signature

[Kalle Valo]

Arend van Spriel <arend.vanspriel@broadcom.com> wrote:

> The function cfg80211_set_channel() is an static function in brcmfmac
> but the name is misleading. Hence rename it with 'brcmf' prefix. Also
> changing the parameters to avoid additional conversions.
> 
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>

Patch applied to wireless-next.git, thanks.

5fac18583a00 wifi: brcmfmac: change cfg80211_set_channel() name and signature

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20230103124117.271988-4-arend.vanspriel@broadcom.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches