projects / openwrt / staging / ansuel.git / blob
? search:


45a9a339fad3ccdd711fb9c47d0ea1db85022983
[openwrt/staging/ansuel.git] /
1 From a84a60ccdd65278485fb495f468a5ab91a75c649 Mon Sep 17 00:00:00 2001
2 From: Arend van Spriel <arend.vanspriel@broadcom.com>
3 Date: Thu, 11 Jul 2019 11:05:06 +0200
4 Subject: [PATCH] Revert "brcmfmac: fix NULL pointer derefence during USB
5 disconnect"
6
7 This reverts commit 5cdb0ef6144f47440850553579aa923c20a63f23. Subsequent
8 changes make rework the driver code fixing the issue differently.
9
10 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
11 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
12 ---
13 .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 11 ++---------
14 .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h | 6 ++----
15 .../wireless/broadcom/brcm80211/brcmfmac/core.c | 4 +---
16 .../broadcom/brcm80211/brcmfmac/fwsignal.c | 16 ++++------------
17 .../broadcom/brcm80211/brcmfmac/fwsignal.h | 3 +--
18 .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++--------
19 .../wireless/broadcom/brcm80211/brcmfmac/proto.h | 3 +--
20 7 files changed, 13 insertions(+), 40 deletions(-)
21
22 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
23 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
24 @@ -479,18 +479,11 @@ fail:
25 return -ENOMEM;
26 }
27
28 -void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
29 -{
30 - struct brcmf_bcdc *bcdc = drvr->proto->pd;
31 -
32 - brcmf_fws_detach_pre_delif(bcdc->fws);
33 -}
34 -
35 -void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
36 +void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
37 {
38 struct brcmf_bcdc *bcdc = drvr->proto->pd;
39
40 drvr->proto->pd = NULL;
41 - brcmf_fws_detach_post_delif(bcdc->fws);
42 + brcmf_fws_detach(bcdc->fws);
43 kfree(bcdc);
44 }
45 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
46 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
47 @@ -7,16 +7,14 @@
48
49 #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
50 int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
51 -void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
52 -void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
53 +void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
54 void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
55 void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
56 bool success);
57 struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
58 #else
59 static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
60 -static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
61 -static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
62 +static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
63 #endif
64
65 #endif /* BRCMFMAC_BCDC_H */
66 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
67 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
68 @@ -1335,8 +1335,6 @@ void brcmf_detach(struct device *dev)
69
70 brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
71
72 - brcmf_proto_detach_pre_delif(drvr);
73 -
74 /* make sure primary interface removed last */
75 for (i = BRCMF_MAX_IFS-1; i > -1; i--)
76 brcmf_remove_interface(drvr->iflist[i], false);
77 @@ -1346,7 +1344,7 @@ void brcmf_detach(struct device *dev)
78
79 brcmf_bus_stop(drvr->bus_if);
80
81 - brcmf_proto_detach_post_delif(drvr);
82 + brcmf_proto_detach(drvr);
83
84 bus_if->drvr = NULL;
85 wiphy_free(drvr->wiphy);
86 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
87 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
88 @@ -2432,25 +2432,17 @@ struct brcmf_fws_info *brcmf_fws_attach(
89 return fws;
90
91 fail:
92 - brcmf_fws_detach_pre_delif(fws);
93 - brcmf_fws_detach_post_delif(fws);
94 + brcmf_fws_detach(fws);
95 return ERR_PTR(rc);
96 }
97
98 -void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
99 +void brcmf_fws_detach(struct brcmf_fws_info *fws)
100 {
101 if (!fws)
102 return;
103 - if (fws->fws_wq) {
104 - destroy_workqueue(fws->fws_wq);
105 - fws->fws_wq = NULL;
106 - }
107 -}
108
109 -void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
110 -{
111 - if (!fws)
112 - return;
113 + if (fws->fws_wq)
114 + destroy_workqueue(fws->fws_wq);
115
116 /* cleanup */
117 brcmf_fws_lock(fws);
118 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
119 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
120 @@ -7,8 +7,7 @@
121 #define FWSIGNAL_H_
122
123 struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
124 -void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
125 -void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
126 +void brcmf_fws_detach(struct brcmf_fws_info *fws);
127 void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
128 bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
129 bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
130 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
131 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
132 @@ -56,22 +56,16 @@ fail:
133 return -ENOMEM;
134 }
135
136 -void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
137 +void brcmf_proto_detach(struct brcmf_pub *drvr)
138 {
139 brcmf_dbg(TRACE, "Enter\n");
140
141 if (drvr->proto) {
142 if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
143 - brcmf_proto_bcdc_detach_post_delif(drvr);
144 + brcmf_proto_bcdc_detach(drvr);
145 else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
146 brcmf_proto_msgbuf_detach(drvr);
147 kfree(drvr->proto);
148 drvr->proto = NULL;
149 }
150 }
151 -
152 -void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
153 -{
154 - if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
155 - brcmf_proto_bcdc_detach_pre_delif(drvr);
156 -}
157 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
158 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
159 @@ -43,8 +43,7 @@ struct brcmf_proto {
160
161
162 int brcmf_proto_attach(struct brcmf_pub *drvr);
163 -void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
164 -void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
165 +void brcmf_proto_detach(struct brcmf_pub *drvr);
166
167 static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
168 struct sk_buff *skb,
Staging tree of Christian Marangi