1. 19 Jan, 2017 3 commits
    • Xinming Hu's avatar
      mwifiex: remove redundant dma padding in AMSDU · 5f0a221f
      Xinming Hu authored
      We already ensure 64 bytes alignment and add padding if required
      during skb_aggr allocation.
      
      Alignment and padding in mwifiex_11n_form_amsdu_txpd() is redundant.
      We may end up accessing more data than allocated size with this.
      
      This patch fixes following issue by removing redundant padding.
      
      [  370.241338] skbuff: skb_over_panic: text:ffffffffc046946a len:3550
      put:72 head:ffff880000110000 data:ffff8800001100e4 tail:0xec2 end:0xec0 dev:<NULL>
      [  370.241374] ------------[ cut here ]------------
      [  370.241382] kernel BUG at net/core/skbuff.c:104!
        370.244032] Call Trace:
      [  370.244041]  [<ffffffff8c3df5ec>] skb_put+0x44/0x45
      [  370.244055]  [<ffffffffc046946a>]
      mwifiex_11n_aggregate_pkt+0x1e9/0xa50 [mwifiex]
      [  370.244067]  [<ffffffffc0467c16>] mwifiex_wmm_process_tx+0x44a/0x6b7
      [mwifiex]
      [  370.244074]  [<ffffffffc0411eb8>] ? 0xffffffffc0411eb8
      [  370.244084]  [<ffffffffc046116b>] mwifiex_main_process+0x476/0x5a5
      [mwifiex]
      [  370.244098]  [<ffffffffc0461298>] mwifiex_main_process+0x5a3/0x5a5
      [mwifiex]
      [  370.244113]  [<ffffffff8be7e9ff>] process_one_work+0x1a4/0x309
      [  370.244123]  [<ffffffff8be7f4ca>] worker_thread+0x20c/0x2ee
      [  370.244130]  [<ffffffff8be7f2be>] ? rescuer_thread+0x383/0x383
      [  370.244136]  [<ffffffff8be7f2be>] ? rescuer_thread+0x383/0x383
      [  370.244143]  [<ffffffff8be83742>] kthread+0x11c/0x124
      [  370.244150]  [<ffffffff8be83626>] ? kthread_parkme+0x24/0x24
      [  370.244157]  [<ffffffff8c4da1ef>] ret_from_fork+0x3f/0x70
      [  370.244168]  [<ffffffff8be83626>] ? kthread_parkme+0x24/0x24
      
      Fixes: 84b313b3 ("mwifiex: make tx packet 64 byte DMA aligned")
      Signed-off-by: default avatarXinming Hu <huxm@marvell.com>
      Signed-off-by: default avatarAmitkumar Karwar <akarwar@marvell.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      5f0a221f
    • Rafał Miłecki's avatar
      brcmfmac: make brcmf_of_probe more generic · e457a8a0
      Rafał Miłecki authored
      We may want to use Open Firmware for other devices than just SDIO ones.
      In future we may want to support more Broadcom properties so there is
      really no reason for such limitation.
      
      Call brcmf_of_probe for all kind of devices & move extra conditions to
      the body of that funcion.
      Signed-off-by: default avatarRafał Miłecki <rafal@milecki.pl>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      e457a8a0
    • Pan Bian's avatar
      libertas: fix improper return value · 259010c5
      Pan Bian authored
      Function lbs_cmd_802_11_sleep_params() always return 0, even if the call
      to lbs_cmd_with_response() fails. In this case, the parameter @sp will
      keep uninitialized. Because the return value is 0, its caller (say
      lbs_sleepparams_read()) will not detect the error, and will copy the
      uninitialized stack memory to user sapce, resulting in stack information
      leak. To avoid the bug, this patch returns variable ret (which takes
      the return value of lbs_cmd_with_response()) instead of 0.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      259010c5
  2. 17 Jan, 2017 14 commits
  3. 12 Jan, 2017 13 commits
  4. 11 Jan, 2017 4 commits
  5. 10 Jan, 2017 6 commits