Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d8a531cf authored by Kalle Valo's avatar Kalle Valo
Browse files

Merge tag 'iwlwifi-for-kalle-2017-03-29' of...

Merge tag 'iwlwifi-for-kalle-2017-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes

iwlwifi fixes for 4.11

Here are three patches intended for 4.11.  The first one is an RCU fix
by Sari.  The second one is a fix for a potential out-of-bounds access
crash by Dan.  And finally, the third and bigger one, is a fix for
IBSS, which has been broken since DQA was enabled in the driver.
parents 6be3b6cc 4d339989
Loading
Loading
Loading
Loading
+2 −0
Original line number Diff line number Diff line
@@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,

	if (ret)
		return ret;
	if (count == 0)
		return 0;

	iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf,
			       (count - 1), NULL);
+2 −1
Original line number Diff line number Diff line
@@ -216,7 +216,8 @@ u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif)
			qmask |= BIT(vif->hw_queue[ac]);
	}

	if (vif->type == NL80211_IFTYPE_AP)
	if (vif->type == NL80211_IFTYPE_AP ||
	    vif->type == NL80211_IFTYPE_ADHOC)
		qmask |= BIT(vif->cab_queue);

	return qmask;
+1 −1
Original line number Diff line number Diff line
@@ -2401,7 +2401,7 @@ void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
		return;

	rcu_read_lock();
	sta = mvm->fw_id_to_mac_id[notif->sta_id];
	sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
	if (WARN_ON(IS_ERR_OR_NULL(sta))) {
		rcu_read_unlock();
		return;
+6 −3
Original line number Diff line number Diff line
@@ -1806,7 +1806,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
			iwl_mvm_get_wd_timeout(mvm, vif, false, false);
		int queue;

		if (vif->type == NL80211_IFTYPE_AP)
		if (vif->type == NL80211_IFTYPE_AP ||
		    vif->type == NL80211_IFTYPE_ADHOC)
			queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
		else if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
			queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
@@ -1837,7 +1838,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
	 * enabled-cab_queue to the mask)
	 */
	if (iwl_mvm_is_dqa_supported(mvm) &&
	    vif->type == NL80211_IFTYPE_AP) {
	    (vif->type == NL80211_IFTYPE_AP ||
	     vif->type == NL80211_IFTYPE_ADHOC)) {
		struct iwl_trans_txq_scd_cfg cfg = {
			.fifo = IWL_MVM_TX_FIFO_MCAST,
			.sta_id = mvmvif->bcast_sta.sta_id,
@@ -1862,7 +1864,8 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,

	lockdep_assert_held(&mvm->mutex);

	if (vif->type == NL80211_IFTYPE_AP)
	if (vif->type == NL80211_IFTYPE_AP ||
	    vif->type == NL80211_IFTYPE_ADHOC)
		iwl_mvm_disable_txq(mvm, vif->cab_queue, vif->cab_queue,
				    IWL_MAX_TID_COUNT, 0);

+5 −2
Original line number Diff line number Diff line
@@ -506,6 +506,7 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,

	switch (info->control.vif->type) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_ADHOC:
		/*
		 * Handle legacy hostapd as well, where station may be added
		 * only after assoc. Take care of the case where we send a
@@ -517,7 +518,8 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
		if (info->hw_queue == info->control.vif->cab_queue)
			return info->hw_queue;

		WARN_ONCE(1, "fc=0x%02x", le16_to_cpu(fc));
		WARN_ONCE(info->control.vif->type != NL80211_IFTYPE_ADHOC,
			  "fc=0x%02x", le16_to_cpu(fc));
		return IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
	case NL80211_IFTYPE_P2P_DEVICE:
		if (ieee80211_is_mgmt(fc))
@@ -584,7 +586,8 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
			iwl_mvm_vif_from_mac80211(info.control.vif);

		if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE ||
		    info.control.vif->type == NL80211_IFTYPE_AP) {
		    info.control.vif->type == NL80211_IFTYPE_AP ||
		    info.control.vif->type == NL80211_IFTYPE_ADHOC) {
			sta_id = mvmvif->bcast_sta.sta_id;
			queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info,
							   hdr->frame_control);