Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f5e9f8d authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'wireless-drivers-for-davem-2017-04-03' of... 

Merge tag 'wireless-drivers-for-davem-2017-04-03' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers



Kalle Valo says:

====================
wireless-drivers fixes for 4.11

iwlwifi

* an RCU fix
* a fix for a potential out-of-bounds access crash
* a fix for IBSS which has been broken since DQA was enabled

rtlwifi

* fix scheduling while atomic regression

brcmfmac

* fix use-after-free bug found by KASAN
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f38b3766 d77facb8

drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c

+5 −3
Original line number Diff line number Diff line
@@ -2238,14 +2238,16 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev) 
	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);

	struct brcmf_p2p_info *p2p = &cfg->p2p;

	struct brcmf_cfg80211_vif *vif;

	enum nl80211_iftype iftype;

	bool wait_for_disable = false;

	int err;



	brcmf_dbg(TRACE, "delete P2P vif\n");

	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);



	iftype = vif->wdev.iftype;

	brcmf_cfg80211_arm_vif_event(cfg, vif);

	switch (vif->wdev.iftype) {

	switch (iftype) {

	case NL80211_IFTYPE_P2P_CLIENT:

		if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state))

			wait_for_disable = true;
@@ -2275,7 +2277,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev) 
					    BRCMF_P2P_DISABLE_TIMEOUT);



	err = 0;

	if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) {

	if (iftype != NL80211_IFTYPE_P2P_DEVICE) {

		brcmf_vif_clear_mgmt_ies(vif);

		err = brcmf_p2p_release_p2p_if(vif);

	}
@@ -2291,7 +2293,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev) 
	brcmf_remove_interface(vif->ifp, true);



	brcmf_cfg80211_arm_vif_event(cfg, NULL);

	if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)

	if (iftype != NL80211_IFTYPE_P2P_DEVICE)

		p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;



	return err;

drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c

+2 −0
Original line number Diff line number Diff line
@@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm, 


	if (ret)

		return ret;

	if (count == 0)

		return 0;



	iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf,

			       (count - 1), NULL);

drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c

+2 −1
Original line number Diff line number Diff line
@@ -216,7 +216,8 @@ u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif) 
			qmask |= BIT(vif->hw_queue[ac]);

	}



	if (vif->type == NL80211_IFTYPE_AP)

	if (vif->type == NL80211_IFTYPE_AP ||

	    vif->type == NL80211_IFTYPE_ADHOC)

		qmask |= BIT(vif->cab_queue);



	return qmask;

drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c

+1 −1
Original line number Diff line number Diff line
@@ -2401,7 +2401,7 @@ void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb) 
		return;



	rcu_read_lock();

	sta = mvm->fw_id_to_mac_id[notif->sta_id];

	sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);

	if (WARN_ON(IS_ERR_OR_NULL(sta))) {

		rcu_read_unlock();

		return;

drivers/net/wireless/intel/iwlwifi/mvm/sta.c

+6 −3
Original line number Diff line number Diff line
@@ -1806,7 +1806,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif) 
			iwl_mvm_get_wd_timeout(mvm, vif, false, false);

		int queue;



		if (vif->type == NL80211_IFTYPE_AP)

		if (vif->type == NL80211_IFTYPE_AP ||

		    vif->type == NL80211_IFTYPE_ADHOC)

			queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;

		else if (vif->type == NL80211_IFTYPE_P2P_DEVICE)

			queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
@@ -1837,7 +1838,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif) 
	 * enabled-cab_queue to the mask)

	 */

	if (iwl_mvm_is_dqa_supported(mvm) &&

	    vif->type == NL80211_IFTYPE_AP) {

	    (vif->type == NL80211_IFTYPE_AP ||

	     vif->type == NL80211_IFTYPE_ADHOC)) {

		struct iwl_trans_txq_scd_cfg cfg = {

			.fifo = IWL_MVM_TX_FIFO_MCAST,

			.sta_id = mvmvif->bcast_sta.sta_id,
@@ -1862,7 +1864,8 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm, 


	lockdep_assert_held(&mvm->mutex);



	if (vif->type == NL80211_IFTYPE_AP)

	if (vif->type == NL80211_IFTYPE_AP ||

	    vif->type == NL80211_IFTYPE_ADHOC)

		iwl_mvm_disable_txq(mvm, vif->cab_queue, vif->cab_queue,

				    IWL_MAX_TID_COUNT, 0);