- 28 Jul, 2017 40 commits
-
-
Souptick Joarder authored
This patch will fix memory leak when firmware request fails Signed-off-by:
Souptick Joarder <jrdr.linux@gmail.com> Acked-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
Kalle Valo <kvalo@codeaurora.org>
-
Souptick Joarder authored
Removing unused dummy function Signed-off-by:
-
Souptick Joarder authored
_rtl92cu_init_usb_aggregation() can be removed as it is dummy one Signed-off-by:
-
Ping-Ke Shih authored
Use rtlpriv instead of rtlhal as argument, so driver and btcoex use the same definitions. Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
-
Ping-Ke Shih authored
We should check addr1 to indicate a packet as broadcast or multicast in tx desc. An obvious example, a STA transmit an *unicast* ARP packet where addr1 and DA are the addresses of AP and broadcast respectively. Signed-off-by:
-
Ping-Ke Shih authored
This is a common enumeration, so we use a common name. Signed-off-by:
-
Ping-Ke Shih authored
There are new PHY table values for the RTL8723BE. The changes require new parsing code. Signed-off-by:
-
Ping-Ke Shih authored
With correct amplifier_type, the phy praser can choose correct parameters. Signed-off-by:
-
Ping-Ke Shih authored
With correct board_type, the phy praser can choose correct parameters. Signed-off-by:
-
Ping-Ke Shih authored
We use H2C to ask BT's status, and C2H will return the status. Signed-off-by:
-
Ping-Ke Shih authored
Because it isn't always correct to use EAPOL to check 4-way, we add a timer to handle exception. Signed-off-by:
-
Colin Ian King authored
Trivial fix to spelling mistake in printk message Signed-off-by:
Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Arvind Yadav authored
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. Signed-off-by:
Arvind Yadav <arvind.yadav.cs@gmail.com> Acked-by:
Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by:
-
Colin Ian King authored
Trivial fix to spelling mistake in PDEBUG debug message. Signed-off-by:
-
Dan Williams authored
Causes the PCI stack to complain, and then eventually call the PCI remove function, which ipw2100 is not expecting. It then tries to unregister an already-released netdev and other nasty things, leading to a panic. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1185518Signed-off-by:
Dan Williams <dcbw@redhat.com> Signed-off-by:
-
Colin Ian King authored
Trivial fix to spelling mistake in mwifiex_dbg debug message Signed-off-by:
-
Colin Ian King authored
Trivial fix to spelling mistake in aggr_ctrl module parameter message text. Signed-off-by:
-
Xinming Hu authored
Tdls uapsd support capability is default disabled during tdls setup, correspondingly it should also been disabled in tdls config. Signed-off-by:
Xinming Hu <huxm@marvell.com> Signed-off-by:
Cathy Luo <cluo@marvell.com> Signed-off-by:
Zhiyuan Yang <yangzy@marvell.com> Signed-off-by:
-
Dan Carpenter authored
We need to unlock if mwifiex_usb_prepare_tx_aggr_skb() fails. Fixes: a2ca85ad ("mwifiex: usb: add timer to flush aggregation packets") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Jeffy Chen authored
We inited wakeup info at the beginning of mwifiex_add_card, so we need to uninit it in the error handling. It's much the same as what we did in: 36908c4e mwifiex: uninit wakeup info when removing device Signed-off-by:
Jeffy Chen <jeffy.chen@rock-chips.com> Reviewed-by:
Brian Norris <briannorris@chromium.org> Signed-off-by:
-
Shawn Lin authored
We got a compile warning shows below: drivers/net/wireless/marvell/mwifiex/sdio.c: In function 'mwifiex_sdio_remove': drivers/net/wireless/marvell/mwifiex/sdio.c:377:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] Per the code, it didn't check if mwifiex_sdio_read_fw_status finish successfully. We should at least check the return of mwifiex_sdio_read_fw_status, otherwise the following check of firmware_stat and adapter->mfg_mode is pointless as the device is probably dead. Signed-off-by:
Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by:
-
Brian Norris authored
This print isn't very useful. It's also different between mwifiex_add_card() and mwifiex_reinit_sw(), and I'd like to consolidate them eventually. Signed-off-by:
-
Brian Norris authored
It has some scary comments about "only being called" from the timeout handler, so let's help keep it that way. Signed-off-by:
-
Brian Norris authored
'card->dev' is initialized once and is never cleared. Drop the unnecessary "safety" check, as it simply obscures things, and we don't do this check everywhere (and therefore it's not really "safe"). Signed-off-by:
-
Brian Norris authored
In testing the mwifiex reset code path, I've noticed KASAN complaining about some "overwritten poison values" in our RX buffer descriptors. Because KASAN didn't notice this at the time of a CPU write, this seems to suggest that the device is writing to this memory. This makes a little sense, because when resetting, we don't necessarily expect the device to be responsive, so we don't have a chance to disable everything cleanly. We can at least take the precaution of disabling DMA for the device though, and in my testing that seems to clear up this particular issue. This patch reorders the removal path so that we disable the device *before* releasing our last PCIe buffers, and it clears/sets the bus master feature from the PCI device when resetting. Along the way, remove the insufficient (and confusing) error path in mwifiex_pcie_up_dev() (it doesn't unwind things well enough, and it doesn't propagate its errors upward anyway). Signed-off-by:
-
Brian Norris authored
The card_reset() implementation should be setting our state flags and cancelling commands for us (i.e., in mwifiex_shutdown_drv()), so let's not do it here. Also, this debugfs file is useful for testing and debugging the reset feature, so we shouldn't do extra preparatory steps here, as that might cause different reset behavior, which could either cause new bugs or paper over existing ones that this debug feature should otherwise help us catch. Signed-off-by:
-
Brian Norris authored
After removing the interrupt loop in commit 5d5ddb5e ("mwifiex: pcie: don't loop/retry interrupt status checks"), there is practically zero difference between mwifiex_process_pcie_int() (which handled legacy PCI interrupts and MSI interrupts) and mwifiex_process_msix_int() (which handled MSI-X interrupts). Let's add the one relevant line to mwifiex_process_pcie_int() and kill the copy-and-paste. Signed-off-by:
-
Brian Norris authored
After removing the interrupt loop in commit 5d5ddb5e ("mwifiex: pcie: don't loop/retry interrupt status checks"), we don't need to keep track of the cleared interrupts (actually, we didn't need to do that before, but we *really* don't need to now). Signed-off-by:
-
Brian Norris authored
It's always called with 'true' -- we only determine it 'false' locally within this function. So drop the parameter. Also, this should be 'bool' (since we use true/false), not 'u32'. Signed-off-by:
-
Brian Norris authored
Signed-off-by:
-
Brian Norris authored
We're open-coding these. Just use the helpers. Signed-off-by:
-
Brian Norris authored
It doesn't fail. Signed-off-by:
-
Brian Norris authored
Despite the name (and meticulous comments), this function frees no memory and does not touch any locks. All it does is "delete" the list heads -- which just means they'll be dangling, and we'll need to re-init them if we use them again. It seems like this code would work OK as a sort of canary for using the list after we've torn everything down, so it's fine to keep the code; let's just get the name and comments to match what's actually happening. Signed-off-by:
-
Brian Norris authored
The .idle_time field *should* be unused, but technically, we're allowing unitialized stack garbage to pass all the way through to the firmware host command. Let's zero it out instead. Signed-off-by:
-
Brian Norris authored
In reading through _mwifiex_fw_dpc(), I noticed that after we've registered our wiphy, we still have error paths that don't free it back up. Let's do that. Signed-off-by:
-
Brian Norris authored
When we leave the delete interface function, there are still netdev hooks that might try to process the device. We're short-circuiting some of that by changing the interface type and clearing ieee80211_ptr. This means we skip NETDEV_UNREGISTER_FINAL in cfg80211. Fortunately, that is currently a no-op. We don't need most of the cleanup here anyway: * the connection state will get (un)set as part of the disconnect process (which cfg80211 already initiates for us) * the interface type doesn't actually need to be cleared at all (it'll trigger a WARN_ON() in cfg80211 if we do) * the iee80211_ptr isn't really "ours" to clear anyway So stop resetting those 3 things. Signed-off-by:
-
Brian Norris authored
It's possible for some control interfaces (e.g., scans, set freq) to be active after we've stopped our main work queue and the netif TX queues. These don't get completely shut out until we've unregistered the wdevs and wiphy. So let's only free command buffers and poison our lists after wiphy_unregister(). This resolves various use-after-free issues seen when resetting the device. Cc: Johannes Berg <johannes@sipsolutions.net> Signed-off-by:
-
Brian Norris authored
In general, it's helpful to use the same code for device removal as for device reset, as this tends to have fewer bugs. Let's move the wiphy unregistration code into the common reset and removal code. In particular, it's very hard to properly handle the reset sequence when something fails. Currently, if mwifiex_reinit_sw() fails, we've failed to unregister the associated wiphy, and so running something as simple as "iw phy" can trigger an OOPS, as the wiphy still has hooks back into freed mwifiex data structures. For example, KASAN complained: [... see reset fail for other reasons ...] [ 1184.821158] mwifiex_pcie 0000:01:00.0: info: dnld wifi firmware from 174948 bytes [ 1186.870914] mwifiex_pcie 0000:01:00.0: info: FW download over, size 608396 bytes [ 1187.685990] mwifiex_pcie 0000:01:00.0: WLAN FW is active [ 1187.692673] mwifiex_pcie 0000:01:00.0: cmd_wait_q terminated: -512 [ 1187.699075] mwifiex_pcie 0000:01:00.0: info: _mwifiex_fw_dpc: unregister device [ 1187.713476] mwifiex: Failed to bring up adapter: -5 [ 1187.718644] mwifiex_pcie 0000:01:00.0: reinit failed: -5 [... run `iw phy` ...] [ 1212.902419] ================================================================== [ 1212.909806] BUG: KASAN: use-after-free in mwifiex_cfg80211_get_antenna+0x54/0xfc [mwifiex] at addr ffffffc0ad1a8028 [ 1212.920246] Read of size 1 by task iw/3127 [...] [ 1212.934946] page dumped because: kasan: bad access detected [...] [ 1212.950665] Call trace: [ 1212.953148] [<ffffffc00020a69c>] dump_backtrace+0x0/0x190 [ 1212.958572] [<ffffffc00020a96c>] show_stack+0x20/0x28 [ 1212.963648] [<ffffffc0005ce18c>] dump_stack+0xa4/0xcc [ 1212.968723] [<ffffffc0003c4430>] kasan_report+0x378/0x500 [ 1212.974140] [<ffffffc0003c3358>] __asan_load1+0x44/0x4c [ 1212.979462] [<ffffffbffc2e8360>] mwifiex_cfg80211_get_antenna+0x54/0xfc [mwifiex] [ 1212.987131] [<ffffffbffc084fc4>] nl80211_send_wiphy+0x75c/0x2de0 [cfg80211] [ 1212.994246] [<ffffffbffc094f60>] nl80211_dump_wiphy+0x32c/0x438 [cfg80211] [ 1213.001149] [<ffffffc000ab6404>] genl_lock_dumpit+0x48/0x64 [ 1213.006746] [<ffffffc000ab3474>] netlink_dump+0x178/0x398 [ 1213.012171] [<ffffffc000ab3d18>] __netlink_dump_start+0x1bc/0x260 [...] This all goes away if we just tear down the wiphy on the way down, and set it back up if/when we bring the device back up. Signed-off-by:
-
Brian Norris authored
In rogue cases (due to other bugs) it's possible we try to process an old command response *after* resetting the device. This could trigger a double-free (or the SKB can get reallocated elsewhere...causing other memory corruptions) in mwifiex_pcie_process_cmd_complete(). For safety (and symmetry) let's always NULL out the command buffer as we free it up. We're already doing this for the command response buffer. Signed-off-by:
-
Brian Norris authored
When resetting the device, we might have queued up interrupts that didn't get a chance to finish processing. We really don't need to handle them at this point; we just want to make sure they don't cause us to try to process old commands from before the device was reset. Signed-off-by:
-
