Commit e80c81dc authored by Amitkumar Karwar's avatar Amitkumar Karwar Committed by John W. Linville

mwifiex: fix bugs in event handling code

This patch ensures uniformity in event skb sent by interface code
(USB/PCIe/SDIO) which automatically fixes following bugs.

1) For USB interface, same buffer is reused for receiving cmd and
events from firmware. While handling events, we perform
skb_pull(skb, 4) to remove event header. Corresponding skb_push()
call is missing while submitting the buffer.
2) For PCIe interface, event skb is passed with event header.
Recently added uAP events EVENT_UAP_STA_ASSOC, EVENT_UAP_STA_DEAUTH
will not work for PCIe, as they assume event skb points to event body.
Signed-off-by: default avatarAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: default avatarKiran Divekar <dkiran@marvell.com>
Signed-off-by: default avatarBing Zhao <bzhao@marvell.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent f03ba7e9
...@@ -978,10 +978,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter, ...@@ -978,10 +978,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
dev_dbg(adapter->dev, "info: --- Rx: Event ---\n"); dev_dbg(adapter->dev, "info: --- Rx: Event ---\n");
adapter->event_cause = *(u32 *) skb->data; adapter->event_cause = *(u32 *) skb->data;
skb_pull(skb, MWIFIEX_EVENT_HEADER_LEN);
if ((skb->len > 0) && (skb->len < MAX_EVENT_SIZE)) if ((skb->len > 0) && (skb->len < MAX_EVENT_SIZE))
memcpy(adapter->event_body, skb->data, skb->len); memcpy(adapter->event_body,
skb->data + MWIFIEX_EVENT_HEADER_LEN,
skb->len);
/* event cause has been saved to adapter->event_cause */ /* event cause has been saved to adapter->event_cause */
adapter->event_received = true; adapter->event_received = true;
......
...@@ -406,9 +406,9 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv) ...@@ -406,9 +406,9 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
break; break;
case EVENT_UAP_STA_ASSOC: case EVENT_UAP_STA_ASSOC:
skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
memset(&sinfo, 0, sizeof(sinfo)); memset(&sinfo, 0, sizeof(sinfo));
event = (struct mwifiex_assoc_event *)adapter->event_skb->data; event = (struct mwifiex_assoc_event *)
(adapter->event_body + MWIFIEX_UAP_EVENT_EXTRA_HEADER);
if (le16_to_cpu(event->type) == TLV_TYPE_UAP_MGMT_FRAME) { if (le16_to_cpu(event->type) == TLV_TYPE_UAP_MGMT_FRAME) {
len = -1; len = -1;
...@@ -433,9 +433,8 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv) ...@@ -433,9 +433,8 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
GFP_KERNEL); GFP_KERNEL);
break; break;
case EVENT_UAP_STA_DEAUTH: case EVENT_UAP_STA_DEAUTH:
skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER); cfg80211_del_sta(priv->netdev, adapter->event_body +
cfg80211_del_sta(priv->netdev, adapter->event_skb->data, MWIFIEX_UAP_EVENT_EXTRA_HEADER, GFP_KERNEL);
GFP_KERNEL);
break; break;
case EVENT_UAP_BSS_IDLE: case EVENT_UAP_BSS_IDLE:
priv->media_connected = false; priv->media_connected = false;
......
...@@ -91,7 +91,6 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter, ...@@ -91,7 +91,6 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
} }
skb_copy_from_linear_data(skb, &tmp, sizeof(u32)); skb_copy_from_linear_data(skb, &tmp, sizeof(u32));
adapter->event_cause = le32_to_cpu(tmp); adapter->event_cause = le32_to_cpu(tmp);
skb_pull(skb, sizeof(u32));
dev_dbg(dev, "event_cause %#x\n", adapter->event_cause); dev_dbg(dev, "event_cause %#x\n", adapter->event_cause);
if (skb->len > MAX_EVENT_SIZE) { if (skb->len > MAX_EVENT_SIZE) {
...@@ -99,8 +98,9 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter, ...@@ -99,8 +98,9 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
return -1; return -1;
} }
skb_copy_from_linear_data(skb, adapter->event_body, memcpy(adapter->event_body, skb->data +
skb->len); MWIFIEX_EVENT_HEADER_LEN, skb->len);
adapter->event_received = true; adapter->event_received = true;
adapter->event_skb = skb; adapter->event_skb = skb;
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment