aboutsummaryrefslogtreecommitdiff
path: root/drivers/net/wireless
AgeCommit message (Collapse)AuthorFilesLines
2017-08-01iwlwifi: refactor shared mem parsingJohannes Berg9-202/+275
Refactor the shared memory command parsing into common code. Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: refactor out paging codeJohannes Berg9-402/+572
Refactor the paging code from mvm to be used by different opmodes. Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: add the new 9000 series PCI IDsTzipi Peres1-0/+20
Add two PCI IDs for the 9160 series. Add five PCI IDs for the 9260 series. Add one PCI IDs for the 9270 series. Add seven PCI IDs for the 9460 series. Add five PCI IDs for the 9560 series. Signed-off-by: Tzipi Peres <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to fwNaftali Goldstein1-1/+2
Set the STA_FLG_RTS_MIMO_PROT bit in station_flags_msk of the add sta command, so that when smps mode changes, the FW will know about it. In particular, in AP mode, clients are added upon receival of an auth request, at which point there's no knowledge of the client's smps mode. When the assoc request arrives, the add_sta command is resent to modify the station parameters. At this point the driver knows the smps mode, but since the corresponding bit in the mask is not set, the fw doesn't update this field so there's no rts protection for mimo. Fixes: 5bc5aaad407c ("iwlwifi: mvm: set up initial SMPS/NSS station info") Signed-off-by: Naftali Goldstein <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: fix fw_pre_next_step to apply also for C stepHaim Dreyfuss3-13/+14
C step NICs should use the latest FW (currently B step). Correct the condition to make C step NICs advanced its default FW name to the latest one. Also rename _next_ to b_or_c to avoid confusion. Fixes: 5da083d1922c ("iwlwifi: add support for 9000 HW B-step NICs") Signed-off-by: Haim Dreyfuss <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: mvm: rs: fix TLC statistics collectionGregory Greenman1-4/+4
Statistics should be collected according to the actual rate a frame/aggregation was transmitted and not according to the initial rate from the last LQ command (these rates are different if the frames were retransmitted at a lower rate from the rate scale table). This is needed to remove throughput degradation. Signed-off-by: Gregory Greenman <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: mvm: set A-MPDU bit upon empty BA notification from FWGregory Greenman1-0/+2
The bit was set only if there was at least one reclaimed frame in an aggregation. It's important to set it also in the case that the whole A-MPDU was lost, otherwise rate scaling statistics will not be updated correctly. Thus, set it always in ba notification handler. This fixes a throughput degradation of about 20% in certain scenarios with multiple streams on 11ac. Signed-off-by: Gregory Greenman <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: split the regulatory rules when the bandwidth flags require itEmmanuel Grumbach1-8/+11
When we create a regulatory domain out of an MCC notification, we need to make sure that all the channels in the rule have the exact same properties. The current code mixes channel 36 and 40 although 36 can be a control channel with HT40+ (36, 40) whereas 40 can't be a control channel with HT40+ since (40, 44) is invalid. Because of that, cfg80211 would allow to connect in 40MHz to APs that are configured to channel 40 HT40+ and that made our firmware assert. Fix this by checking the bandwidth flags before taking the decision if the rule should be split. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195299 partly. Fixes: af45a9003f1f ("iwlwifi: create regdomain from mcc_update_cmd response") Signed-off-by: Emmanuel Grumbach <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: add TLV for MLME offload firmware capabilityEmmanuel Grumbach1-0/+2
The firmware now adds a new DWORD for the MLME offload's capability even on firmware versions that don't support it. Add the TLV bit to avoid getting the print: capa flags index 3 larger than supported by driver. This fixes the bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196195 Signed-off-by: Emmanuel Grumbach <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-08-01iwlwifi: mvm: fix TCP CSUM offload with WEP and A000 seriesEmmanuel Grumbach1-2/+8
When we enabled TCP checksum offload, we need to tell the firmware where the IP header starts. If we have an IV, then we need to adapt that value since the IV is placed before the SNAP header. This is true only for cases where the driver adds the IV, not the WEP case in which the IV is added by the firmware itself. On A000 devices series, the IV is always added by the device. Fix this. Fixes: 5e6a98dc4863 ("iwlwifi: mvm: enable TCP/UDP checksum support for 9000 family") Signed-off-by: Emmanuel Grumbach <[email protected]> Signed-off-by: Luca Coelho <[email protected]>
2017-07-28rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operationDan Carpenter1-1/+1
The cast here is wrong. We want to cast the pointer but we accidentally do a no-op cast of the value. We normally want to set us_nav_upper to WIFI_NAV_UPPER_US (30000) but because of this bug we instead set it to 184 on little endian systems and 0 on big endian ones. Fixes: 3c05bedb5fef ("Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver") Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Larry Finger <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: Fix memory leak when firmware request failsSouptick Joarder9-0/+24
This patch will fix memory leak when firmware request fails Signed-off-by: Souptick Joarder <[email protected]> Acked-by: Larry Finger <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: Remove unused dummy functionSouptick Joarder3-16/+1
Removing unused dummy function Signed-off-by: Souptick Joarder <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: remove dummy function callSouptick Joarder1-5/+0
_rtl92cu_init_usb_aggregation() can be removed as it is dummy one Signed-off-by: Souptick Joarder <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: move IS_HARDWARE_TYPE_xxx checker to wifi.hPing-Ke Shih3-42/+19
Use rtlpriv instead of rtlhal as argument, so driver and btcoex use the same definitions. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Larry Finger <[email protected]> Cc: Yan-Hsuan Chuang <[email protected]> Cc: Birming Chiu <[email protected]> Cc: Shaofu <[email protected]> Cc: Steven Ting <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: Uses addr1 instead DA to determine broadcast and multicast addr.Ping-Ke Shih1-2/+2
We should check addr1 to indicate a packet as broadcast or multicast in tx desc. An obvious example, a STA transmit an *unicast* ARP packet where addr1 and DA are the addresses of AP and broadcast respectively. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Larry Finger <[email protected]> Cc: Yan-Hsuan Chuang <[email protected]> Cc: Birming Chiu <[email protected]> Cc: Shaofu <[email protected]> Cc: Steven Ting <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: Rename rtl_desc92_rate to rtl_desc_ratePing-Ke Shih1-1/+1
This is a common enumeration, so we use a common name. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Larry Finger <[email protected]> Cc: Yan-Hsuan Chuang <[email protected]> Cc: Birming Chiu <[email protected]> Cc: Shaofu <[email protected]> Cc: Steven Ting <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: Update 8723be new phy parameters and its parser.Ping-Ke Shih3-286/+281
There are new PHY table values for the RTL8723BE. The changes require new parsing code. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Larry Finger <[email protected]> Cc: Yan-Hsuan Chuang <[email protected]> Cc: Birming Chiu <[email protected]> Cc: Shaofu <[email protected]> Cc: Steven Ting <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: add amplifier type for 8812aePing-Ke Shih1-1/+40
With correct amplifier_type, the phy praser can choose correct parameters. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Larry Finger <[email protected]> Cc: Yan-Hsuan Chuang <[email protected]> Cc: Birming Chiu <[email protected]> Cc: Shaofu <[email protected]> Cc: Steven Ting <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: Add board type for 8723be and 8192eePing-Ke Shih2-0/+12
With correct board_type, the phy praser can choose correct parameters. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Larry Finger <[email protected]> Cc: Yan-Hsuan Chuang <[email protected]> Cc: Birming Chiu <[email protected]> Cc: Shaofu <[email protected]> Cc: Steven Ting <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: Add BT_MP_INFO to c2h handler.Ping-Ke Shih7-8/+71
We use H2C to ask BT's status, and C2H will return the status. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Larry Finger <[email protected]> Cc: Yan-Hsuan Chuang <[email protected]> Cc: Birming Chiu <[email protected]> Cc: Shaofu <[email protected]> Cc: Steven Ting <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28rtlwifi: Fill in_4way field by driverPing-Ke Shih3-0/+16
Because it isn't always correct to use EAPOL to check 4-way, we add a timer to handle exception. Signed-off-by: Ping-Ke Shih <[email protected]> Signed-off-by: Larry Finger <[email protected]> Cc: Yan-Hsuan Chuang <[email protected]> Cc: Birming Chiu <[email protected]> Cc: Shaofu <[email protected]> Cc: Steven Ting <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28wl3501_cs: fix spelling mistake: "Insupported" -> "Unsupported"Colin Ian King1-1/+1
Trivial fix to spelling mistake in printk message Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28brcmfmac: constify pci_device_idArvind Yadav1-1/+1
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. Signed-off-by: Arvind Yadav <[email protected]> Acked-by: Arend van Spriel <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28zd1211rw: fix spelling mistake 'hybernate' -> 'hibernate'Colin Ian King1-1/+1
Trivial fix to spelling mistake in PDEBUG debug message. Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28ipw2100: don't return positive values to PCI probe on errorDan Williams1-14/+14
Causes the PCI stack to complain, and then eventually call the PCI remove function, which ipw2100 is not expecting. It then tries to unregister an already-released netdev and other nasty things, leading to a panic. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1185518 Signed-off-by: Dan Williams <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: fix spelling mistake: "Insuffient" -> "Insufficient"Colin Ian King1-1/+1
Trivial fix to spelling mistake in mwifiex_dbg debug message Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: usb: fix spelling mistake: "aggreataon"-> "aggregation"Colin Ian King1-1/+1
Trivial fix to spelling mistake in aggr_ctrl module parameter message text. Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: disable uapsd in tdls configXinming Hu1-6/+5
Tdls uapsd support capability is default disabled during tdls setup, correspondingly it should also been disabled in tdls config. Signed-off-by: Xinming Hu <[email protected]> Signed-off-by: Cathy Luo <[email protected]> Signed-off-by: Zhiyuan Yang <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: usb: unlock on error in mwifiex_usb_tx_aggr_tmo()Dan Carpenter1-1/+2
We need to unlock if mwifiex_usb_prepare_tx_aggr_skb() fails. Fixes: a2ca85ad721d ("mwifiex: usb: add timer to flush aggregation packets") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: uninit wakeup info in the error handlingJeffy Chen1-1/+6
We inited wakeup info at the beginning of mwifiex_add_card, so we need to uninit it in the error handling. It's much the same as what we did in: 36908c4 mwifiex: uninit wakeup info when removing device Signed-off-by: Jeffy Chen <[email protected]> Reviewed-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: fix compile warning of unused variableShawn Lin1-1/+2
We got a compile warning shows below: drivers/net/wireless/marvell/mwifiex/sdio.c: In function 'mwifiex_sdio_remove': drivers/net/wireless/marvell/mwifiex/sdio.c:377:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] Per the code, it didn't check if mwifiex_sdio_read_fw_status finish successfully. We should at least check the return of mwifiex_sdio_read_fw_status, otherwise the following check of firmware_stat and adapter->mfg_mode is pointless as the device is probably dead. Signed-off-by: Shawn Lin <[email protected]> Reviewed-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: drop num CPU noticeBrian Norris1-3/+1
This print isn't very useful. It's also different between mwifiex_add_card() and mwifiex_reinit_sw(), and I'd like to consolidate them eventually. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: keep mwifiex_cancel_pending_ioctl() staticBrian Norris2-2/+3
It has some scary comments about "only being called" from the timeout handler, so let's help keep it that way. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: pcie: remove unnecessary 'pdev' checkBrian Norris1-8/+5
'card->dev' is initialized once and is never cleared. Drop the unnecessary "safety" check, as it simply obscures things, and we don't do this check everywhere (and therefore it's not really "safe"). Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: pcie: disable device DMA before unmapping/freeing buffersBrian Norris1-7/+9
In testing the mwifiex reset code path, I've noticed KASAN complaining about some "overwritten poison values" in our RX buffer descriptors. Because KASAN didn't notice this at the time of a CPU write, this seems to suggest that the device is writing to this memory. This makes a little sense, because when resetting, we don't necessarily expect the device to be responsive, so we don't have a chance to disable everything cleanly. We can at least take the precaution of disabling DMA for the device though, and in my testing that seems to clear up this particular issue. This patch reorders the removal path so that we disable the device *before* releasing our last PCIe buffers, and it clears/sets the bus master feature from the PCI device when resetting. Along the way, remove the insufficient (and confusing) error path in mwifiex_pcie_up_dev() (it doesn't unwind things well enough, and it doesn't propagate its errors upward anyway). Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: debugfs: allow card_reset() to cancel thingsBrian Norris1-2/+0
The card_reset() implementation should be setting our state flags and cancelling commands for us (i.e., in mwifiex_shutdown_drv()), so let's not do it here. Also, this debugfs file is useful for testing and debugging the reset feature, so we shouldn't do extra preparatory steps here, as that might cause different reset behavior, which could either cause new bugs or paper over existing ones that this debug feature should otherwise help us catch. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: pcie: unify MSI-X / non-MSI-X interrupt processBrian Norris1-65/+3
After removing the interrupt loop in commit 5d5ddb5e0d9b ("mwifiex: pcie: don't loop/retry interrupt status checks"), there is practically zero difference between mwifiex_process_pcie_int() (which handled legacy PCI interrupts and MSI interrupts) and mwifiex_process_msix_int() (which handled MSI-X interrupts). Let's add the one relevant line to mwifiex_process_pcie_int() and kill the copy-and-paste. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: pcie: remove unnecessary masksBrian Norris1-4/+0
After removing the interrupt loop in commit 5d5ddb5e0d9b ("mwifiex: pcie: don't loop/retry interrupt status checks"), we don't need to keep track of the cleared interrupts (actually, we didn't need to do that before, but we *really* don't need to now). Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: drop 'add_tail' param from mwifiex_insert_cmd_to_pending_q()Brian Norris3-7/+6
It's always called with 'true' -- we only determine it 'false' locally within this function. So drop the parameter. Also, this should be 'bool' (since we use true/false), not 'u32'. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: don't open-code ARRAY_SIZE()Brian Norris3-12/+5
Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: utilize netif_tx_{wake,stop}_all_queues()Brian Norris1-18/+2
We're open-coding these. Just use the helpers. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: make mwifiex_free_cmd_buffer() return voidBrian Norris2-5/+3
It doesn't fail. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: fix misnomers in mwifiex_free_lock_list()Brian Norris1-6/+3
Despite the name (and meticulous comments), this function frees no memory and does not touch any locks. All it does is "delete" the list heads -- which just means they'll be dangling, and we'll need to re-init them if we use them again. It seems like this code would work OK as a sort of canary for using the list after we've torn everything down, so it's fine to keep the code; let's just get the name and comments to match what's actually happening. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: ensure "disable auto DS" struct is initializedBrian Norris1-3/+3
The .idle_time field *should* be unused, but technically, we're allowing unitialized stack garbage to pass all the way through to the firmware host command. Let's zero it out instead. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: fixup init_channel_scan_gap error caseBrian Norris1-1/+2
In reading through _mwifiex_fw_dpc(), I noticed that after we've registered our wiphy, we still have error paths that don't free it back up. Let's do that. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: don't short-circuit netdev notifiers on interface deletionBrian Norris1-4/+0
When we leave the delete interface function, there are still netdev hooks that might try to process the device. We're short-circuiting some of that by changing the interface type and clearing ieee80211_ptr. This means we skip NETDEV_UNREGISTER_FINAL in cfg80211. Fortunately, that is currently a no-op. We don't need most of the cleanup here anyway: * the connection state will get (un)set as part of the disconnect process (which cfg80211 already initiates for us) * the interface type doesn't actually need to be cleared at all (it'll trigger a WARN_ON() in cfg80211 if we do) * the iee80211_ptr isn't really "ours" to clear anyway So stop resetting those 3 things. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: unregister wiphy before freeing resourcesBrian Norris3-1/+10
It's possible for some control interfaces (e.g., scans, set freq) to be active after we've stopped our main work queue and the netif TX queues. These don't get completely shut out until we've unregistered the wdevs and wiphy. So let's only free command buffers and poison our lists after wiphy_unregister(). This resolves various use-after-free issues seen when resetting the device. Cc: Johannes Berg <[email protected]> Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: re-register wiphy across resetBrian Norris1-3/+4
In general, it's helpful to use the same code for device removal as for device reset, as this tends to have fewer bugs. Let's move the wiphy unregistration code into the common reset and removal code. In particular, it's very hard to properly handle the reset sequence when something fails. Currently, if mwifiex_reinit_sw() fails, we've failed to unregister the associated wiphy, and so running something as simple as "iw phy" can trigger an OOPS, as the wiphy still has hooks back into freed mwifiex data structures. For example, KASAN complained: [... see reset fail for other reasons ...] [ 1184.821158] mwifiex_pcie 0000:01:00.0: info: dnld wifi firmware from 174948 bytes [ 1186.870914] mwifiex_pcie 0000:01:00.0: info: FW download over, size 608396 bytes [ 1187.685990] mwifiex_pcie 0000:01:00.0: WLAN FW is active [ 1187.692673] mwifiex_pcie 0000:01:00.0: cmd_wait_q terminated: -512 [ 1187.699075] mwifiex_pcie 0000:01:00.0: info: _mwifiex_fw_dpc: unregister device [ 1187.713476] mwifiex: Failed to bring up adapter: -5 [ 1187.718644] mwifiex_pcie 0000:01:00.0: reinit failed: -5 [... run `iw phy` ...] [ 1212.902419] ================================================================== [ 1212.909806] BUG: KASAN: use-after-free in mwifiex_cfg80211_get_antenna+0x54/0xfc [mwifiex] at addr ffffffc0ad1a8028 [ 1212.920246] Read of size 1 by task iw/3127 [...] [ 1212.934946] page dumped because: kasan: bad access detected [...] [ 1212.950665] Call trace: [ 1212.953148] [<ffffffc00020a69c>] dump_backtrace+0x0/0x190 [ 1212.958572] [<ffffffc00020a96c>] show_stack+0x20/0x28 [ 1212.963648] [<ffffffc0005ce18c>] dump_stack+0xa4/0xcc [ 1212.968723] [<ffffffc0003c4430>] kasan_report+0x378/0x500 [ 1212.974140] [<ffffffc0003c3358>] __asan_load1+0x44/0x4c [ 1212.979462] [<ffffffbffc2e8360>] mwifiex_cfg80211_get_antenna+0x54/0xfc [mwifiex] [ 1212.987131] [<ffffffbffc084fc4>] nl80211_send_wiphy+0x75c/0x2de0 [cfg80211] [ 1212.994246] [<ffffffbffc094f60>] nl80211_dump_wiphy+0x32c/0x438 [cfg80211] [ 1213.001149] [<ffffffc000ab6404>] genl_lock_dumpit+0x48/0x64 [ 1213.006746] [<ffffffc000ab3474>] netlink_dump+0x178/0x398 [ 1213.012171] [<ffffffc000ab3d18>] __netlink_dump_start+0x1bc/0x260 [...] This all goes away if we just tear down the wiphy on the way down, and set it back up if/when we bring the device back up. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
2017-07-28mwifiex: pcie: don't allow cmd buffer reuse after resetBrian Norris1-1/+2
In rogue cases (due to other bugs) it's possible we try to process an old command response *after* resetting the device. This could trigger a double-free (or the SKB can get reallocated elsewhere...causing other memory corruptions) in mwifiex_pcie_process_cmd_complete(). For safety (and symmetry) let's always NULL out the command buffer as we free it up. We're already doing this for the command response buffer. Signed-off-by: Brian Norris <[email protected]> Signed-off-by: Kalle Valo <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.