Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9165bf27 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'wireless' 



John W. Linville says:

====================
This is a small batch of fixes intended for the 3.8 stream...

There are two pulls from Johannes.  Regarding mac80211, Johannes says:

"One fix from Dan for a possible memory overrun."

Regarding iwlwifi,  Johannes says:

"I have one fix from Emmanuel reverting a previous fix that caused
more trouble than it's worth."

Along with those:

Arend van Spriel fixes a fatal error in brcsmac related to tx status processing.

Bing Zhao corrects a problem where mwifiex would fail to complete a scan
in the event of an IE processing error.

Larry Finger fixes a thinko in rtlwifi in which the wrong skb variable
was being used in some cases.

Rafał Miłecki fixes a thinko in an ID check in the bcma flash code.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 66555e92 ed6882ac

drivers/bcma/driver_chipcommon_nflash.c

+1 −1
Original line number Diff line number Diff line
@@ -21,7 +21,7 @@ int bcma_nflash_init(struct bcma_drv_cc *cc) 
	struct bcma_bus *bus = cc->core->bus;



	if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&

	    cc->core->id.rev != 0x38) {

	    cc->core->id.rev != 38) {

		bcma_err(bus, "NAND flash on unsupported board!\n");

		return -ENOTSUPP;

	}

drivers/net/wireless/brcm80211/brcmsmac/main.c

+9 −16
Original line number Diff line number Diff line
@@ -1027,7 +1027,6 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs) 
static bool

brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)

{

	bool morepending = false;

	struct bcma_device *core;

	struct tx_status txstatus, *txs;

	u32 s1, s2;
@@ -1041,23 +1040,20 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal) 
	txs = &txstatus;

	core = wlc_hw->d11core;

	*fatal = false;

	s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));

	while (!(*fatal)

	       && (s1 & TXS_V)) {

		/* !give others some time to run! */

		if (n >= max_tx_num) {

			morepending = true;

			break;

		}



	while (n < max_tx_num) {

		s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));

		if (s1 == 0xffffffff) {

			brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,

				  __func__);

			*fatal = true;

			return false;

		}

		s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));

		/* only process when valid */

		if (!(s1 & TXS_V))

			break;



		s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));

		txs->status = s1 & TXS_STATUS_MASK;

		txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;

		txs->sequence = s2 & TXS_SEQ_MASK;
@@ -1065,15 +1061,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal) 
		txs->lasttxtime = 0;



		*fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);



		s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));

		if (*fatal == true)

			return false;

		n++;

	}



	if (*fatal)

		return false;



	return morepending;

	return n >= max_tx_num;

}



static void brcms_c_tbtt(struct brcms_c_info *wlc)

drivers/net/wireless/iwlwifi/dvm/tx.c

+7 −17
Original line number Diff line number Diff line
@@ -1153,6 +1153,13 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb, 
			next_reclaimed = ssn;

		}



		if (tid != IWL_TID_NON_QOS) {

			priv->tid_data[sta_id][tid].next_reclaimed =

				next_reclaimed;

			IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",

						  next_reclaimed);

		}



		iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);



		iwlagn_check_ratid_empty(priv, sta_id, tid);
@@ -1203,28 +1210,11 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb, 
			if (!is_agg)

				iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);



			/*

			 * W/A for FW bug - the seq_ctl isn't updated when the

			 * queues are flushed. Fetch it from the packet itself

			 */

			if (!is_agg && status == TX_STATUS_FAIL_FIFO_FLUSHED) {

				next_reclaimed = le16_to_cpu(hdr->seq_ctrl);

				next_reclaimed =

					SEQ_TO_SN(next_reclaimed + 0x10);

			}



			is_offchannel_skb =

				(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);

			freed++;

		}



		if (tid != IWL_TID_NON_QOS) {

			priv->tid_data[sta_id][tid].next_reclaimed =

				next_reclaimed;

			IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",

					   next_reclaimed);

		}



		WARN_ON(!is_agg && freed != 1);



		/*

drivers/net/wireless/mwifiex/scan.c

+5 −4
Original line number Diff line number Diff line
@@ -1563,7 +1563,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, 
		dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",

			scan_rsp->number_of_sets);

		ret = -1;

		goto done;

		goto check_next_scan;

	}



	bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1634,7 +1634,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, 
		if (!beacon_size || beacon_size > bytes_left) {

			bss_info += bytes_left;

			bytes_left = 0;

			return -1;

			ret = -1;

			goto check_next_scan;

		}



		/* Initialize the current working beacon pointer for this BSS
@@ -1690,7 +1691,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, 
				dev_err(priv->adapter->dev,

					"%s: bytes left < IE length\n",

					__func__);

				goto done;

				goto check_next_scan;

			}

			if (element_id == WLAN_EID_DS_PARAMS) {

				channel = *(current_ptr + sizeof(struct ieee_types_header));
@@ -1753,6 +1754,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, 
		}

	}



check_next_scan:

	spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);

	if (list_empty(&adapter->scan_pending_q)) {

		spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -1813,7 +1815,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, 
		}

	}



done:

	return ret;

}

drivers/net/wireless/rtlwifi/usb.c

+2 −2
Original line number Diff line number Diff line
@@ -542,8 +542,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb) 
	WARN_ON(skb_queue_empty(&rx_queue));

	while (!skb_queue_empty(&rx_queue)) {

		_skb = skb_dequeue(&rx_queue);

		_rtl_usb_rx_process_agg(hw, skb);

		ieee80211_rx_irqsafe(hw, skb);

		_rtl_usb_rx_process_agg(hw, _skb);

		ieee80211_rx_irqsafe(hw, _skb);

	}

}