source: branches/chaos_calmer/package/kernel/mac80211/patches/351-0051-brcmfmac-use-correct-skb-freeing-helper-when-deletin.patch @ 49407

Last change on this file since 49407 was 49407, checked in by rmilecki, 12 months ago

mac80211: brcmfmac: backport changes from 2016-09-27

This fixes memory leaks, some possible crashes and bug that could cause
WARNING on every add_key/del_key call. It also replaces WARNING with
a simple message. They may still occur e.g. on station going out of
range and A-MPDU stall in the firmware.

Signed-off-by: Rafał Miłecki <rafal@…>

File size: 2.0 KB
  • drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c

    From 7f00ee2bbc630900ba16fc2690473f3e2db0e264 Mon Sep 17 00:00:00 2001
    From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
    Date: Tue, 27 Sep 2016 14:11:04 +0200
    Subject: [PATCH] brcmfmac: use correct skb freeing helper when deleting
     flowring
    MIME-Version: 1.0
    Content-Type: text/plain; charset=UTF-8
    Content-Transfer-Encoding: 8bit
    
    Flowrings contain skbs waiting for transmission that were passed to us
    by netif. It means we checked every one of them looking for 802.1x
    Ethernet type. When deleting flowring we have to use freeing function
    that will check for 802.1x type as well.
    
    Freeing skbs without a proper check was leading to counter not being
    properly decreased. This was triggering a WARNING every time
    brcmf_netdev_wait_pend8021x was called.
    
    Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
    Acked-by: Arend van Spriel <arend@broadcom.com>
    Cc: stable@vger.kernel.org # 4.5+
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    ---
     drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c | 9 ++++++++-
     1 file changed, 8 insertions(+), 1 deletion(-)
    
    a b static void brcmf_flowring_block(struct 
    234234 
    235235void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid) 
    236236{ 
     237        struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev); 
    237238        struct brcmf_flowring_ring *ring; 
     239        struct brcmf_if *ifp; 
    238240        u16 hash_idx; 
     241        u8 ifidx; 
    239242        struct sk_buff *skb; 
    240243 
    241244        ring = flow->rings[flowid]; 
    242245        if (!ring) 
    243246                return; 
     247 
     248        ifidx = brcmf_flowring_ifidx_get(flow, flowid); 
     249        ifp = brcmf_get_ifp(bus_if->drvr, ifidx); 
     250 
    244251        brcmf_flowring_block(flow, flowid, false); 
    245252        hash_idx = ring->hash_id; 
    246253        flow->hash[hash_idx].ifidx = BRCMF_FLOWRING_INVALID_IFIDX; 
    void brcmf_flowring_delete(struct brcmf_ 
    249256 
    250257        skb = skb_dequeue(&ring->skblist); 
    251258        while (skb) { 
    252                 brcmu_pkt_buf_free_skb(skb); 
     259                brcmf_txfinalize(ifp, skb, false); 
    253260                skb = skb_dequeue(&ring->skblist); 
    254261        } 
    255262 
Note: See TracBrowser for help on using the repository browser.