Commit 42afe7d1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'staging-5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging 

Pull staging driver fixes from Greg KH:
 "Here are a small number of tiny staging driver fixes for 5.8-rc3.

  Not much here, but there were some reported problems to be fixed:

   - three wfx driver fixes

   - rtl8723bs driver fix

  All of these have been in linux-next with no reported issues"

* tag 'staging-5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
  staging: wfx: fix coherency of hif_scan() prototype
  staging: wfx: drop useless loop
  staging: wfx: fix AC priority
parents 7eb8f53b b65a2d8c

drivers/staging/rtl8723bs/core/rtw_wlan_util.c

+3 −1
Original line number Diff line number Diff line
@@ -1824,12 +1824,14 @@ int update_sta_support_rate(struct adapter *padapter, u8 *pvar_ie, uint var_ie_l 
	pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len);

	if (!pIE)

		return _FAIL;

	if (ie_len > sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates))

		return _FAIL;



	memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len);

	supportRateNum = ie_len;



	pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len);

	if (pIE)

	if (pIE && (ie_len <= sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates) - supportRateNum))

		memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len);



	return _SUCCESS;

drivers/staging/wfx/hif_tx.c

+4 −2
Original line number Diff line number Diff line
@@ -240,7 +240,7 @@ int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, 
}



int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req,

	     int chan_start_idx, int chan_num)

	     int chan_start_idx, int chan_num, int *timeout)

{

	int ret, i;

	struct hif_msg *hif;
@@ -289,11 +289,13 @@ int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req, 
	tmo_chan_fg = 512 * USEC_PER_TU + body->probe_delay;

	tmo_chan_fg *= body->num_of_probe_requests;

	tmo = chan_num * max(tmo_chan_bg, tmo_chan_fg) + 512 * USEC_PER_TU;

	if (timeout)

		*timeout = usecs_to_jiffies(tmo);



	wfx_fill_header(hif, wvif->id, HIF_REQ_ID_START_SCAN, buf_len);

	ret = wfx_cmd_send(wvif->wdev, hif, NULL, 0, false);

	kfree(hif);

	return ret ? ret : usecs_to_jiffies(tmo);

	return ret;

}



int hif_stop_scan(struct wfx_vif *wvif)

drivers/staging/wfx/hif_tx.h

+1 −1
Original line number Diff line number Diff line
@@ -42,7 +42,7 @@ int hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, 
int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id,

		  void *buf, size_t buf_size);

int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req80211,

	     int chan_start, int chan_num);

	     int chan_start, int chan_num, int *timeout);

int hif_stop_scan(struct wfx_vif *wvif);

int hif_join(struct wfx_vif *wvif, const struct ieee80211_bss_conf *conf,

	     struct ieee80211_channel *channel, const u8 *ssid, int ssidlen);

drivers/staging/wfx/queue.c

+9 −12
Original line number Diff line number Diff line
@@ -246,7 +246,7 @@ static struct sk_buff *wfx_tx_queues_get_skb(struct wfx_dev *wdev) 
	for (i = 0; i < IEEE80211_NUM_ACS; i++) {

		sorted_queues[i] = &wdev->tx_queue[i];

		for (j = i; j > 0; j--)

			if (atomic_read(&sorted_queues[j]->pending_frames) >

			if (atomic_read(&sorted_queues[j]->pending_frames) <

			    atomic_read(&sorted_queues[j - 1]->pending_frames))

				swap(sorted_queues[j - 1], sorted_queues[j]);

	}
@@ -291,8 +291,6 @@ struct hif_msg *wfx_tx_queues_get(struct wfx_dev *wdev) 


	if (atomic_read(&wdev->tx_lock))

		return NULL;



	for (;;) {

	skb = wfx_tx_queues_get_skb(wdev);

	if (!skb)

		return NULL;
@@ -302,4 +300,3 @@ struct hif_msg *wfx_tx_queues_get(struct wfx_dev *wdev) 
	tx_priv->xmit_timestamp = ktime_get();

	return (struct hif_msg *)skb->data;

}
 
}

drivers/staging/wfx/scan.c

+3 −3
Original line number Diff line number Diff line
@@ -56,10 +56,10 @@ static int send_scan_req(struct wfx_vif *wvif, 
	wfx_tx_lock_flush(wvif->wdev);

	wvif->scan_abort = false;

	reinit_completion(&wvif->scan_complete);

	timeout = hif_scan(wvif, req, start_idx, i - start_idx);

	if (timeout < 0) {

	ret = hif_scan(wvif, req, start_idx, i - start_idx, &timeout);

	if (ret) {

		wfx_tx_unlock(wvif->wdev);

		return timeout;

		return -EIO;

	}

	ret = wait_for_completion_timeout(&wvif->scan_complete, timeout);

	if (req->channels[start_idx]->max_power != wvif->vif->bss_conf.txpower)

CRA Git | Maintained and supported by SUSTech CRA and CCSE