Commit 42afe7d1 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'staging-5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are a small number of tiny staging driver fixes for 5.8-rc3.

  Not much here, but there were some reported problems to be fixed:

   - three wfx driver fixes

   - rtl8723bs driver fix

  All of these have been in linux-next with no reported issues"

* tag 'staging-5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
  staging: wfx: fix coherency of hif_scan() prototype
  staging: wfx: drop useless loop
  staging: wfx: fix AC priority
parents 7eb8f53b b65a2d8c
...@@ -1824,12 +1824,14 @@ int update_sta_support_rate(struct adapter *padapter, u8 *pvar_ie, uint var_ie_l ...@@ -1824,12 +1824,14 @@ int update_sta_support_rate(struct adapter *padapter, u8 *pvar_ie, uint var_ie_l
pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len); pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
if (!pIE) if (!pIE)
return _FAIL; return _FAIL;
if (ie_len > sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates))
return _FAIL;
memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len); memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len);
supportRateNum = ie_len; supportRateNum = ie_len;
pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len); pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
if (pIE) if (pIE && (ie_len <= sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates) - supportRateNum))
memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len); memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len);
return _SUCCESS; return _SUCCESS;
......
...@@ -240,7 +240,7 @@ int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, ...@@ -240,7 +240,7 @@ int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id,
} }
int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req, int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req,
int chan_start_idx, int chan_num) int chan_start_idx, int chan_num, int *timeout)
{ {
int ret, i; int ret, i;
struct hif_msg *hif; struct hif_msg *hif;
...@@ -289,11 +289,13 @@ int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req, ...@@ -289,11 +289,13 @@ int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req,
tmo_chan_fg = 512 * USEC_PER_TU + body->probe_delay; tmo_chan_fg = 512 * USEC_PER_TU + body->probe_delay;
tmo_chan_fg *= body->num_of_probe_requests; tmo_chan_fg *= body->num_of_probe_requests;
tmo = chan_num * max(tmo_chan_bg, tmo_chan_fg) + 512 * USEC_PER_TU; tmo = chan_num * max(tmo_chan_bg, tmo_chan_fg) + 512 * USEC_PER_TU;
if (timeout)
*timeout = usecs_to_jiffies(tmo);
wfx_fill_header(hif, wvif->id, HIF_REQ_ID_START_SCAN, buf_len); wfx_fill_header(hif, wvif->id, HIF_REQ_ID_START_SCAN, buf_len);
ret = wfx_cmd_send(wvif->wdev, hif, NULL, 0, false); ret = wfx_cmd_send(wvif->wdev, hif, NULL, 0, false);
kfree(hif); kfree(hif);
return ret ? ret : usecs_to_jiffies(tmo); return ret;
} }
int hif_stop_scan(struct wfx_vif *wvif) int hif_stop_scan(struct wfx_vif *wvif)
......
...@@ -42,7 +42,7 @@ int hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, ...@@ -42,7 +42,7 @@ int hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id,
int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id,
void *buf, size_t buf_size); void *buf, size_t buf_size);
int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req80211, int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req80211,
int chan_start, int chan_num); int chan_start, int chan_num, int *timeout);
int hif_stop_scan(struct wfx_vif *wvif); int hif_stop_scan(struct wfx_vif *wvif);
int hif_join(struct wfx_vif *wvif, const struct ieee80211_bss_conf *conf, int hif_join(struct wfx_vif *wvif, const struct ieee80211_bss_conf *conf,
struct ieee80211_channel *channel, const u8 *ssid, int ssidlen); struct ieee80211_channel *channel, const u8 *ssid, int ssidlen);
......
...@@ -246,7 +246,7 @@ static struct sk_buff *wfx_tx_queues_get_skb(struct wfx_dev *wdev) ...@@ -246,7 +246,7 @@ static struct sk_buff *wfx_tx_queues_get_skb(struct wfx_dev *wdev)
for (i = 0; i < IEEE80211_NUM_ACS; i++) { for (i = 0; i < IEEE80211_NUM_ACS; i++) {
sorted_queues[i] = &wdev->tx_queue[i]; sorted_queues[i] = &wdev->tx_queue[i];
for (j = i; j > 0; j--) for (j = i; j > 0; j--)
if (atomic_read(&sorted_queues[j]->pending_frames) > if (atomic_read(&sorted_queues[j]->pending_frames) <
atomic_read(&sorted_queues[j - 1]->pending_frames)) atomic_read(&sorted_queues[j - 1]->pending_frames))
swap(sorted_queues[j - 1], sorted_queues[j]); swap(sorted_queues[j - 1], sorted_queues[j]);
} }
...@@ -291,8 +291,6 @@ struct hif_msg *wfx_tx_queues_get(struct wfx_dev *wdev) ...@@ -291,8 +291,6 @@ struct hif_msg *wfx_tx_queues_get(struct wfx_dev *wdev)
if (atomic_read(&wdev->tx_lock)) if (atomic_read(&wdev->tx_lock))
return NULL; return NULL;
for (;;) {
skb = wfx_tx_queues_get_skb(wdev); skb = wfx_tx_queues_get_skb(wdev);
if (!skb) if (!skb)
return NULL; return NULL;
...@@ -301,5 +299,4 @@ struct hif_msg *wfx_tx_queues_get(struct wfx_dev *wdev) ...@@ -301,5 +299,4 @@ struct hif_msg *wfx_tx_queues_get(struct wfx_dev *wdev)
tx_priv = wfx_skb_tx_priv(skb); tx_priv = wfx_skb_tx_priv(skb);
tx_priv->xmit_timestamp = ktime_get(); tx_priv->xmit_timestamp = ktime_get();
return (struct hif_msg *)skb->data; return (struct hif_msg *)skb->data;
}
} }
...@@ -56,10 +56,10 @@ static int send_scan_req(struct wfx_vif *wvif, ...@@ -56,10 +56,10 @@ static int send_scan_req(struct wfx_vif *wvif,
wfx_tx_lock_flush(wvif->wdev); wfx_tx_lock_flush(wvif->wdev);
wvif->scan_abort = false; wvif->scan_abort = false;
reinit_completion(&wvif->scan_complete); reinit_completion(&wvif->scan_complete);
timeout = hif_scan(wvif, req, start_idx, i - start_idx); ret = hif_scan(wvif, req, start_idx, i - start_idx, &timeout);
if (timeout < 0) { if (ret) {
wfx_tx_unlock(wvif->wdev); wfx_tx_unlock(wvif->wdev);
return timeout; return -EIO;
} }
ret = wait_for_completion_timeout(&wvif->scan_complete, timeout); ret = wait_for_completion_timeout(&wvif->scan_complete, timeout);
if (req->channels[start_idx]->max_power != wvif->vif->bss_conf.txpower) if (req->channels[start_idx]->max_power != wvif->vif->bss_conf.txpower)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment