mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-23 15:32:33 +00:00
a8cc06c537
This pick most of brcmfmac changes backported into the master in commits5932eb690f("mac80211: brcmfmac: backport firmware loading cleanup")3eab6b8275("mac80211: brcmfmac: backport NVRAM loading improvements")529c95cc15("mac80211: brcmfmac: fix use-after-free & possible NULL pointer dereference") It's more than would be normally backported into a stable branch but it seems required. Firmware loading cleanups are needed to allow fix memory bugs in a reliable way. Memory fixes are really important to avoid corrupting memory and risking a NULL pointer dereference. Hopefully this stuff has received enough testing in the master. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
103 lines
2.8 KiB
Diff
103 lines
2.8 KiB
Diff
From a1a3b762163868ad07a4499a73df324f40d5ab0b Mon Sep 17 00:00:00 2001
|
|
From: Hans de Goede <hdegoede@redhat.com>
|
|
Date: Wed, 10 Oct 2018 13:00:58 +0200
|
|
Subject: [PATCH] brcmfmac: Remove firmware-loading code duplication
|
|
|
|
brcmf_fw_request_next_item and brcmf_fw_request_done both have identical
|
|
code to complete the fw-request depending on the item-type.
|
|
|
|
This commit adds a new brcmf_fw_complete_request helper removing this code
|
|
duplication.
|
|
|
|
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
|
|
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
|
---
|
|
.../broadcom/brcm80211/brcmfmac/firmware.c | 62 +++++++++++-----------
|
|
1 file changed, 31 insertions(+), 31 deletions(-)
|
|
|
|
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
|
|
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
|
|
@@ -504,6 +504,34 @@ fail:
|
|
return -ENOENT;
|
|
}
|
|
|
|
+static int brcmf_fw_complete_request(const struct firmware *fw,
|
|
+ struct brcmf_fw *fwctx)
|
|
+{
|
|
+ struct brcmf_fw_item *cur = &fwctx->req->items[fwctx->curpos];
|
|
+ int ret = 0;
|
|
+
|
|
+ brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path, fw ? "" : "not ");
|
|
+
|
|
+ switch (cur->type) {
|
|
+ case BRCMF_FW_TYPE_NVRAM:
|
|
+ ret = brcmf_fw_request_nvram_done(fw, fwctx);
|
|
+ break;
|
|
+ case BRCMF_FW_TYPE_BINARY:
|
|
+ if (fw)
|
|
+ cur->binary = fw;
|
|
+ else
|
|
+ ret = -ENOENT;
|
|
+ break;
|
|
+ default:
|
|
+ /* something fishy here so bail out early */
|
|
+ brcmf_err("unknown fw type: %d\n", cur->type);
|
|
+ release_firmware(fw);
|
|
+ ret = -EINVAL;
|
|
+ }
|
|
+
|
|
+ return (cur->flags & BRCMF_FW_REQF_OPTIONAL) ? 0 : ret;
|
|
+}
|
|
+
|
|
static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
|
|
{
|
|
struct brcmf_fw_item *cur;
|
|
@@ -525,15 +553,7 @@ static int brcmf_fw_request_next_item(st
|
|
if (ret < 0) {
|
|
brcmf_fw_request_done(NULL, fwctx);
|
|
} else if (!async && fw) {
|
|
- brcmf_dbg(TRACE, "firmware %s %sfound\n", cur->path,
|
|
- fw ? "" : "not ");
|
|
- if (cur->type == BRCMF_FW_TYPE_BINARY)
|
|
- cur->binary = fw;
|
|
- else if (cur->type == BRCMF_FW_TYPE_NVRAM)
|
|
- brcmf_fw_request_nvram_done(fw, fwctx);
|
|
- else
|
|
- release_firmware(fw);
|
|
-
|
|
+ brcmf_fw_complete_request(fw, fwctx);
|
|
return -EAGAIN;
|
|
}
|
|
return 0;
|
|
@@ -547,28 +567,8 @@ static void brcmf_fw_request_done(const
|
|
|
|
cur = &fwctx->req->items[fwctx->curpos];
|
|
|
|
- brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
|
|
- fw ? "" : "not ");
|
|
-
|
|
- if (!fw)
|
|
- ret = -ENOENT;
|
|
-
|
|
- switch (cur->type) {
|
|
- case BRCMF_FW_TYPE_NVRAM:
|
|
- ret = brcmf_fw_request_nvram_done(fw, fwctx);
|
|
- break;
|
|
- case BRCMF_FW_TYPE_BINARY:
|
|
- cur->binary = fw;
|
|
- break;
|
|
- default:
|
|
- /* something fishy here so bail out early */
|
|
- brcmf_err("unknown fw type: %d\n", cur->type);
|
|
- release_firmware(fw);
|
|
- ret = -EINVAL;
|
|
- goto fail;
|
|
- }
|
|
-
|
|
- if (ret < 0 && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
|
|
+ ret = brcmf_fw_complete_request(fw, fwctx);
|
|
+ if (ret < 0)
|
|
goto fail;
|
|
|
|
do {
|