Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'staging-5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are a small number of tiny staging driver fixes for 5.8-rc3.
Not much here, but there were some reported problems to be fixed:
- three wfx driver fixes
- rtl8723bs driver fix
All of these have been in linux-next with no reported issues"
* tag 'staging-5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
staging: wfx: fix coherency of hif_scan() prototype
staging: wfx: drop useless loop
staging: wfx: fix AC priority
+20
-19
+3
-1
drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+3
-1
drivers/staging/rtl8723bs/core/rtw_wlan_util.c
···
1824
1824
pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
1825
1825
if (!pIE)
1826
1826
return _FAIL;
1827
+
if (ie_len > sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates))
1828
+
return _FAIL;
1827
1829
1828
1830
memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len);
1829
1831
supportRateNum = ie_len;
1830
1832
1831
1833
pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
1832
-
if (pIE)
1834
+
if (pIE && (ie_len <= sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates) - supportRateNum))
1833
1835
memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len);
1834
1836
1835
1837
return _SUCCESS;
+4
-2
drivers/staging/wfx/hif_tx.c
+4
-2
drivers/staging/wfx/hif_tx.c
···
240
240
}
241
241
242
242
int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req,
243
-
int chan_start_idx, int chan_num)
243
+
int chan_start_idx, int chan_num, int *timeout)
244
244
{
245
245
int ret, i;
246
246
struct hif_msg *hif;
···
289
289
tmo_chan_fg = 512 * USEC_PER_TU + body->probe_delay;
290
290
tmo_chan_fg *= body->num_of_probe_requests;
291
291
tmo = chan_num * max(tmo_chan_bg, tmo_chan_fg) + 512 * USEC_PER_TU;
292
+
if (timeout)
293
+
*timeout = usecs_to_jiffies(tmo);
292
294
293
295
wfx_fill_header(hif, wvif->id, HIF_REQ_ID_START_SCAN, buf_len);
294
296
ret = wfx_cmd_send(wvif->wdev, hif, NULL, 0, false);
295
297
kfree(hif);
296
-
return ret ? ret : usecs_to_jiffies(tmo);
298
+
return ret;
297
299
}
298
300
299
301
int hif_stop_scan(struct wfx_vif *wvif)
+1
-1
drivers/staging/wfx/hif_tx.h
+1
-1
drivers/staging/wfx/hif_tx.h
···
42
42
int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id,
43
43
void *buf, size_t buf_size);
44
44
int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req80211,
45
-
int chan_start, int chan_num);
45
+
int chan_start, int chan_num, int *timeout);
46
46
int hif_stop_scan(struct wfx_vif *wvif);
47
47
int hif_join(struct wfx_vif *wvif, const struct ieee80211_bss_conf *conf,
48
48
struct ieee80211_channel *channel, const u8 *ssid, int ssidlen);
+9
-12
drivers/staging/wfx/queue.c
+9
-12
drivers/staging/wfx/queue.c
···
246
246
for (i = 0; i < IEEE80211_NUM_ACS; i++) {
247
247
sorted_queues[i] = &wdev->tx_queue[i];
248
248
for (j = i; j > 0; j--)
249
-
if (atomic_read(&sorted_queues[j]->pending_frames) >
249
+
if (atomic_read(&sorted_queues[j]->pending_frames) <
250
250
atomic_read(&sorted_queues[j - 1]->pending_frames))
251
251
swap(sorted_queues[j - 1], sorted_queues[j]);
252
252
}
···
291
291
292
292
if (atomic_read(&wdev->tx_lock))
293
293
return NULL;
294
-
295
-
for (;;) {
296
-
skb = wfx_tx_queues_get_skb(wdev);
297
-
if (!skb)
298
-
return NULL;
299
-
skb_queue_tail(&wdev->tx_pending, skb);
300
-
wake_up(&wdev->tx_dequeue);
301
-
tx_priv = wfx_skb_tx_priv(skb);
302
-
tx_priv->xmit_timestamp = ktime_get();
303
-
return (struct hif_msg *)skb->data;
304
-
}
294
+
skb = wfx_tx_queues_get_skb(wdev);
295
+
if (!skb)
296
+
return NULL;
297
+
skb_queue_tail(&wdev->tx_pending, skb);
298
+
wake_up(&wdev->tx_dequeue);
299
+
tx_priv = wfx_skb_tx_priv(skb);
300
+
tx_priv->xmit_timestamp = ktime_get();
301
+
return (struct hif_msg *)skb->data;
305
302
}
+3
-3
drivers/staging/wfx/scan.c
+3
-3
drivers/staging/wfx/scan.c
···
56
56
wfx_tx_lock_flush(wvif->wdev);
57
57
wvif->scan_abort = false;
58
58
reinit_completion(&wvif->scan_complete);
59
-
timeout = hif_scan(wvif, req, start_idx, i - start_idx);
60
-
if (timeout < 0) {
59
+
ret = hif_scan(wvif, req, start_idx, i - start_idx, &timeout);
60
+
if (ret) {
61
61
wfx_tx_unlock(wvif->wdev);
62
-
return timeout;
62
+
return -EIO;
63
63
}
64
64
ret = wait_for_completion_timeout(&wvif->scan_complete, timeout);
65
65
if (req->channels[start_idx]->max_power != wvif->vif->bss_conf.txpower)