From a9c790ba23eb3b3649f012f9633be2cb5e73e588 Mon Sep 17 00:00:00 2001 From: Xinming Hu Date: Thu, 16 Jun 2016 18:52:22 +0530 Subject: mwifiex: factor out mwifiex_cancel_scan This patch creates common function mwifiex_cancel_scan to remove duplication of code. Signed-off-by: Xinming Hu Signed-off-by: Amitkumar Karwar Signed-off-by: Kalle Valo --- drivers/net/wireless/marvell/mwifiex/scan.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'drivers/net/wireless/marvell/mwifiex/scan.c') diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c index bc5e52cebce1..e33112298fec 100644 --- a/drivers/net/wireless/marvell/mwifiex/scan.c +++ b/drivers/net/wireless/marvell/mwifiex/scan.c @@ -2001,6 +2001,32 @@ static void mwifiex_check_next_scan_command(struct mwifiex_private *priv) return; } +void mwifiex_cancel_scan(struct mwifiex_adapter *adapter) +{ + struct mwifiex_private *priv; + unsigned long cmd_flags; + int i; + + mwifiex_cancel_pending_scan_cmd(adapter); + + if (adapter->scan_processing) { + spin_lock_irqsave(&adapter->mwifiex_cmd_lock, cmd_flags); + adapter->scan_processing = false; + spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags); + for (i = 0; i < adapter->priv_num; i++) { + priv = adapter->priv[i]; + if (!priv) + continue; + if (priv->scan_request) { + mwifiex_dbg(adapter, INFO, + "info: aborting scan\n"); + cfg80211_scan_done(priv->scan_request, 1); + priv->scan_request = NULL; + } + } + } +} + /* * This function handles the command response of scan. * -- cgit From 09e672a16b92902f411eecc180397191ee5a7e05 Mon Sep 17 00:00:00 2001 From: Amitkumar Karwar Date: Mon, 27 Jun 2016 14:16:28 +0530 Subject: mwifiex: clear scan_aborting flag The flag should be cleaned along with other scan operation variables. This was missing at some places. Signed-off-by: Amitkumar Karwar Signed-off-by: Kalle Valo --- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/net/wireless/marvell/mwifiex/scan.c') diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c index e33112298fec..96d0d8652678 100644 --- a/drivers/net/wireless/marvell/mwifiex/scan.c +++ b/drivers/net/wireless/marvell/mwifiex/scan.c @@ -1960,6 +1960,7 @@ static void mwifiex_check_next_scan_command(struct mwifiex_private *priv) "info: notifying scan done\n"); cfg80211_scan_done(priv->scan_request, 0); priv->scan_request = NULL; + priv->scan_aborting = false; } else { priv->scan_aborting = false; mwifiex_dbg(adapter, INFO, @@ -1981,6 +1982,7 @@ static void mwifiex_check_next_scan_command(struct mwifiex_private *priv) "info: aborting scan\n"); cfg80211_scan_done(priv->scan_request, 1); priv->scan_request = NULL; + priv->scan_aborting = false; } else { priv->scan_aborting = false; mwifiex_dbg(adapter, INFO, @@ -2022,6 +2024,7 @@ void mwifiex_cancel_scan(struct mwifiex_adapter *adapter) "info: aborting scan\n"); cfg80211_scan_done(priv->scan_request, 1); priv->scan_request = NULL; + priv->scan_aborting = false; } } } -- cgit From 16d25da94f3d6542a0bbd25a85d247c970026f8a Mon Sep 17 00:00:00 2001 From: Amitkumar Karwar Date: Mon, 27 Jun 2016 14:16:29 +0530 Subject: mwifiex: fix NULL pointer dereference during suspend This patch fixes below NULL pointer dereference observed in suspend stress test. When scan is cancelled during system suspend, we may end up aceesing "priv->scan_request" in corner case. [ 3035.304682] BUG: KASAN: null-ptr-deref on address 0000000000000008 [ 3035.304704] Read of size 4 by task ksdioirqd/mmc2/1183 [ 3035.304744] CPU: 0 PID: 1183 Comm: ksdioirqd/mmc2 Tainted: G W 3.18.0 #1169 [ 3035.304772] Call trace: [ 3035.304825] [] dump_backtrace+0x0/0x190 [ 3035.304864] [] show_stack+0x1c/0x28 [ 3035.304901] [] dump_stack+0xa0/0xf8 [ 3035.304940] [] kasan_report+0x120/0x4fc [ 3035.304975] [] __asan_load4+0x20/0x80 [ 3035.305546] [] mwifiex_check_next_scan_command+0x1a4/0x588 [mwifiex] [ 3035.306091] [] mwifiex_handle_event_ext_scan_report+0x304/0x370 [mwifiex] [ 3035.306735] [] mwifiex_process_sta_event+0x6c0/0xf10 [mwifiex] [ 3035.307200] [] mwifiex_process_event+0x2f4/0x358 [mwifiex] [ 3035.307612] [] mwifiex_main_process+0x3cc/0x80c [mwifiex] [ 3035.307737] [] mwifiex_sdio_interrupt+0x198/0x1c0 [mwifiex_sdio] [ 3035.307785] [] process_sdio_pending_irqs+0x15c/0x1d4 [ 3035.307826] [] sdio_irq_thread+0xd8/0x288 Signed-off-by: Amitkumar Karwar Signed-off-by: Kalle Valo --- drivers/net/wireless/marvell/mwifiex/scan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/net/wireless/marvell/mwifiex/scan.c') diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c index 96d0d8652678..87e700009fd0 100644 --- a/drivers/net/wireless/marvell/mwifiex/scan.c +++ b/drivers/net/wireless/marvell/mwifiex/scan.c @@ -1896,7 +1896,8 @@ mwifiex_active_scan_req_for_passive_chan(struct mwifiex_private *priv) u8 id = 0; struct mwifiex_user_scan_cfg *user_scan_cfg; - if (adapter->active_scan_triggered || !priv->scan_request) { + if (adapter->active_scan_triggered || !priv->scan_request || + priv->scan_aborting) { adapter->active_scan_triggered = false; return 0; } -- cgit