Merge "wil6210: prevent ioctl access while in reset or suspend" (728feafc) · Commits · e / devices / android_kernel_oneplus_sm8150

drivers/net/wireless/ath/wil6210/ioctl.c

+20 −3

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2014,2017 Qualcomm Atheros, Inc.
		* Copyright (c) 2019, The Linux Foundation. All rights reserved.
		*
		* Permission to use, copy, modify, and/or distribute this software for any
		* purpose with or without fee is hereby granted, provided that the above
		@@ -70,6 +71,7 @@ static int wil_ioc_memio_dword(struct wil6210_priv wil, void __user data)
		struct wil_memio io;
		void __iomem *a;
		bool need_copy = false;
		int rc;

		if (copy_from_user(&io, data, sizeof(io)))
		return -EFAULT;
		@@ -83,6 +85,11 @@ static int wil_ioc_memio_dword(struct wil6210_priv wil, void __user data)
		io.op);
		return -EINVAL;
		}

		rc = wil_mem_access_lock(wil);
		if (rc)
		return rc;

		/* operation */
		switch (io.op & wil_mmio_op_mask) {
		case wil_mmio_read:
		@@ -97,9 +104,12 @@ static int wil_ioc_memio_dword(struct wil6210_priv wil, void __user data)
		#endif
		default:
		wil_err(wil, "Unsupported operation, op = 0x%08x\n", io.op);
		wil_mem_access_unlock(wil);
		return -EINVAL;
		}

		wil_mem_access_unlock(wil);

		if (need_copy) {
		wil_dbg_ioctl(wil,
		"IO done: addr(0x%08x) val(0x%08x) op(0x%08x)\n",
		@@ -141,6 +151,12 @@ static int wil_ioc_memio_block(struct wil6210_priv wil, void __user data)
		if (!block)
		return -ENOMEM;

		rc = wil_mem_access_lock(wil);
		if (rc) {
		kfree(block);
		return rc;
		}

		/* operation */
		switch (io.op & wil_mmio_op_mask) {
		case wil_mmio_read:
		@@ -148,14 +164,14 @@ static int wil_ioc_memio_block(struct wil6210_priv wil, void __user data)
		wil_hex_dump_ioctl("Read ", block, io.size);
		if (copy_to_user(io.block, block, io.size)) {
		rc = -EFAULT;
		goto out_free;
		goto out_unlock;
		}
		break;
		#if defined(CONFIG_WIL6210_WRITE_IOCTL)
		case wil_mmio_write:
		if (copy_from_user(block, io.block, io.size)) {
		rc = -EFAULT;
		goto out_free;
		goto out_unlock;
		}
		wil_memcpy_toio_32(a, block, io.size);
		wmb(); /* make sure write propagated to HW */
		@@ -168,7 +184,8 @@ static int wil_ioc_memio_block(struct wil6210_priv wil, void __user data)
		break;
		}

		out_free:
		out_unlock:
		wil_mem_access_unlock(wil);
		kfree(block);
		return rc;
		}

drivers/net/wireless/ath/wil6210/main.c

+0 −5

Original line number	Diff line number	Diff line
		@@ -1571,11 +1571,6 @@ static void wil_pre_fw_config(struct wil6210_priv *wil)
		if (wil->hw_version < HW_VER_TALYN_MB) {
		wil_s(wil, RGF_CAF_ICR + offsetof(struct RGF_ICR, ICR), 0);
		wil_w(wil, RGF_CAF_ICR + offsetof(struct RGF_ICR, IMV), ~0);
		} else {
		wil_s(wil,
		RGF_CAF_ICR_TALYN_MB + offsetof(struct RGF_ICR, ICR), 0);
		wil_w(wil, RGF_CAF_ICR_TALYN_MB +
		offsetof(struct RGF_ICR, IMV), ~0);
		}
		/* clear PAL_UNIT_ICR (potential D0->D3 leftover)
		* In Talyn-MB host cannot access this register due to