Merge "wil6210: check null pointer in _wil_cfg80211_merge_extra_ies" (c7ce1751) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/net/wireless/ath/wil6210/cfg80211.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -1841,6 +1841,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
		u8 buf, dpos;
		const u8 *spos;

		if (!ies1)
		ies1_len = 0;

		if (!ies2)
		ies2_len = 0;

		if (ies1_len == 0 && ies2_len == 0) {
		*merged_ies = NULL;
		*merged_len = 0;
		@@ -1850,6 +1856,7 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
		buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
		if (!buf)
		return -ENOMEM;
		if (ies1)
		memcpy(buf, ies1, ies1_len);
		dpos = buf + ies1_len;
		spos = ies2;
		@@ -1860,7 +1867,8 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
		if (spos + ielen > ies2 + ies2_len)
		break;
		if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
		!_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {
		(!ies1 \|\| !_wil_cfg80211_find_ie(ies1, ies1_len,
		spos, ielen))) {
		memcpy(dpos, spos, ielen);
		dpos += ielen;
		}

drivers/net/wireless/ath/wil6210/debugfs.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -949,6 +949,8 @@ static ssize_t wil_write_file_txmgmt(struct file file, const char __user buf,
		int rc;
		void *frame;

		memset(&params, 0, sizeof(params));

		if (!len)
		return -EINVAL;

drivers/net/wireless/ath/wil6210/interrupt.c

+9 −16

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: ISC
		/*
		* Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
		* Copyright (c) 2018, The Linux Foundation. All rights reserved.
		*
		* Permission to use, copy, modify, and/or distribute this software for any
		* purpose with or without fee is hereby granted, provided that the above
		* copyright notice and this permission notice appear in all copies.
		*
		* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
		* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
		* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
		* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
		* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
		* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
		* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
		* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
		*/

		#include <linux/interrupt.h>
		@@ -575,11 +564,15 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
		}

		if (isr & BIT_DMA_EP_MISC_ICR_HALP) {
		isr &= ~BIT_DMA_EP_MISC_ICR_HALP;
		if (atomic_read(&wil->halp.handle_icr)) {
		/* no need to handle HALP ICRs until next vote */
		atomic_set(&wil->halp.handle_icr, 0);
		wil_dbg_irq(wil, "irq_misc: HALP IRQ invoked\n");
		wil6210_mask_halp(wil);
		isr &= ~BIT_DMA_EP_MISC_ICR_HALP;
		complete(&wil->halp.comp);
		}
		}

		wil->isr_misc = isr;

drivers/net/wireless/ath/wil6210/main.c

+11 −2

Original line number	Diff line number	Diff line
		@@ -1411,8 +1411,15 @@ static void wil_pre_fw_config(struct wil6210_priv *wil)
		wil6210_clear_irq(wil);
		/* CAF_ICR - clear and mask */
		/* it is W1C, clear by writing back same value */
		if (wil->hw_version < HW_VER_TALYN_MB) {
		wil_s(wil, RGF_CAF_ICR + offsetof(struct RGF_ICR, ICR), 0);
		wil_w(wil, RGF_CAF_ICR + offsetof(struct RGF_ICR, IMV), ~0);
		} else {
		wil_s(wil,
		RGF_CAF_ICR_TALYN_MB + offsetof(struct RGF_ICR, ICR), 0);
		wil_w(wil, RGF_CAF_ICR_TALYN_MB +
		offsetof(struct RGF_ICR, IMV), ~0);
		}
		/* clear PAL_UNIT_ICR (potential D0->D3 leftover)
		* In Talyn-MB host cannot access this register due to
		* access control, hence PAL_UNIT_ICR is cleared by the FW
		@@ -1836,6 +1843,8 @@ void wil_halp_vote(struct wil6210_priv *wil)

		if (++wil->halp.ref_cnt == 1) {
		reinit_completion(&wil->halp.comp);
		/* mark to IRQ context to handle HALP ICR */
		atomic_set(&wil->halp.handle_icr, 1);
		wil6210_set_halp(wil);
		rc = wait_for_completion_timeout(&wil->halp.comp, to_jiffies);
		if (!rc) {

drivers/net/wireless/ath/wil6210/txrx_edma.c

+14 −14

Original line number	Diff line number	Diff line
		@@ -834,22 +834,23 @@ static int wil_rx_error_check_edma(struct wil6210_priv *wil,
		wil_dbg_txrx(wil, "L2 RX error, l2_rx_status=0x%x\n",
		l2_rx_status);
		/* Due to HW issue, KEY error will trigger a MIC error */
		if (l2_rx_status & WIL_RX_EDMA_ERROR_MIC) {
		wil_dbg_txrx(wil,
		if (l2_rx_status == WIL_RX_EDMA_ERROR_MIC) {
		wil_err_ratelimited(wil,
		"L2 MIC/KEY error, dropping packet\n");
		stats->rx_mic_error++;
		}
		if (l2_rx_status & WIL_RX_EDMA_ERROR_KEY) {
		wil_dbg_txrx(wil, "L2 KEY error, dropping packet\n");
		if (l2_rx_status == WIL_RX_EDMA_ERROR_KEY) {
		wil_err_ratelimited(wil,
		"L2 KEY error, dropping packet\n");
		stats->rx_key_error++;
		}
		if (l2_rx_status & WIL_RX_EDMA_ERROR_REPLAY) {
		wil_dbg_txrx(wil,
		if (l2_rx_status == WIL_RX_EDMA_ERROR_REPLAY) {
		wil_err_ratelimited(wil,
		"L2 REPLAY error, dropping packet\n");
		stats->rx_replay++;
		}
		if (l2_rx_status & WIL_RX_EDMA_ERROR_AMSDU) {
		wil_dbg_txrx(wil,
		if (l2_rx_status == WIL_RX_EDMA_ERROR_AMSDU) {
		wil_err_ratelimited(wil,
		"L2 AMSDU error, dropping packet\n");
		stats->rx_amsdu_error++;
		}
		@@ -1149,7 +1150,7 @@ int wil_tx_sring_handler(struct wil6210_priv *wil,
		/* Total number of completed descriptors in all descriptor rings */
		int desc_cnt = 0;
		int cid;
		struct wil_net_stats *stats = NULL;
		struct wil_net_stats *stats;
		struct wil_tx_enhanced_desc *_d;
		unsigned int ring_id;
		unsigned int num_descs;
		@@ -1199,8 +1200,7 @@ int wil_tx_sring_handler(struct wil6210_priv *wil,
		ndev = vif_to_ndev(vif);

		cid = wil->ring2cid_tid[ring_id][0];
		if (cid < WIL6210_MAX_CID)
		stats = &wil->sta[cid].stats;
		stats = (cid < WIL6210_MAX_CID ? &wil->sta[cid].stats : NULL);

		wil_dbg_txrx(wil,
		"tx_status: completed desc_ring (%d), num_descs (%d)\n",