mac80211: brcmfmac: backport firmware loading changes & fix memory bugs

This pick most of brcmfmac changes backported into the master in commits
5932eb690f24 ("mac80211: brcmfmac: backport firmware loading cleanup")
3eab6b8275b2 ("mac80211: brcmfmac: backport NVRAM loading improvements")
529c95cc15dc ("mac80211: brcmfmac: fix use-after-free & possible NULL pointer dereference")

It's more than would be normally backported into a stable branch but it
seems required. Firmware loading cleanups are needed to allow fix memory
bugs in a reliable way. Memory fixes are really important to avoid
corrupting memory and risking a NULL pointer dereference.

Hopefully this stuff has received enough testing in the master.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

1 files changed, 41 insertions, 0 deletions

diff --git a/package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch b/package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch
new file mode 100644
index 0000000000..211e9e4a9f
--- /dev/null
+++ b/package/kernel/mac80211/patches/355-v5.0-0006-brcmfmac-Cleanup-brcmf_fw_request_done.patch
@@ -0,0 +1,41 @@
+From 55e491edbf14b2da5419c2a319ea3b1d6368d9a2 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 10 Oct 2018 13:01:03 +0200
+Subject: [PATCH] brcmfmac: Cleanup brcmf_fw_request_done()
+
+The "cur" variable is now only used for a debug print and we already
+print the same info from brcmf_fw_complete_request(), so the debug print
+does not provide any extra info and we can remove it.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -560,22 +560,16 @@ static int brcmf_fw_request_firmware(con
+ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
+ {
+ 	struct brcmf_fw *fwctx = ctx;
+-	struct brcmf_fw_item *cur;
+-	int ret = 0;
+-
+-	cur = &fwctx->req->items[fwctx->curpos];
++	int ret;
+ 
+ 	ret = brcmf_fw_complete_request(fw, fwctx);
+ 
+ 	while (ret == 0 && ++fwctx->curpos < fwctx->req->n_items) {
+-		cur = &fwctx->req->items[fwctx->curpos];
+ 		brcmf_fw_request_firmware(&fw, fwctx);
+ 		ret = brcmf_fw_complete_request(fw, ctx);
+ 	}
+ 
+ 	if (ret) {
+-		brcmf_dbg(TRACE, "failed err=%d: dev=%s, fw=%s\n", ret,
+-			  dev_name(fwctx->dev), cur->path);
+ 		brcmf_fw_free_request(fwctx->req);
+ 		fwctx->req = NULL;
+ 	}