diff options
| author | Rafał Miłecki <rafal@milecki.pl> | 2019-01-08 10:01:08 +0100 |
|---|---|---|
| committer | Rafał Miłecki <rafal@milecki.pl> | 2019-01-08 10:12:07 +0100 |
| commit | a8cc06c5371eca2ae8ab4511c7136d0ebd9ee3bc (patch) | |
| tree | 7b591eb33402aa256ea777d7300a6a593a4b4c1e /package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch | |
| parent | c5c20f510a19f0eb5500fefde1f366f48c168e85 (diff) | |
| download | upstream-a8cc06c5371eca2ae8ab4511c7136d0ebd9ee3bc.tar.gz upstream-a8cc06c5371eca2ae8ab4511c7136d0ebd9ee3bc.tar.bz2 upstream-a8cc06c5371eca2ae8ab4511c7136d0ebd9ee3bc.zip | |
mac80211: brcmfmac: backport firmware loading changes & fix memory bugs
This pick most of brcmfmac changes backported into the master in commits
5932eb690f24 ("mac80211: brcmfmac: backport firmware loading cleanup")
3eab6b8275b2 ("mac80211: brcmfmac: backport NVRAM loading improvements")
529c95cc15dc ("mac80211: brcmfmac: fix use-after-free & possible NULL pointer dereference")
It's more than would be normally backported into a stable branch but it
seems required. Firmware loading cleanups are needed to allow fix memory
bugs in a reliable way. Memory fixes are really important to avoid
corrupting memory and risking a NULL pointer dereference.
Hopefully this stuff has received enough testing in the master.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Diffstat (limited to 'package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch')
| -rw-r--r-- | package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch | 26 |
1 files changed, 14 insertions, 12 deletions
diff --git a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch index e70738322d..2e710d3d62 100644 --- a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch +++ b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch @@ -31,35 +31,37 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com> }; static void brcmf_fw_request_done(const struct firmware *fw, void *ctx); -@@ -589,6 +590,8 @@ fail: - fwctx->req = NULL; - done: +@@ -574,6 +575,8 @@ static void brcmf_fw_request_done(const + fwctx->req = NULL; + } fwctx->done(fwctx->dev, ret, fwctx->req); + if (fwctx->completion) + complete(fwctx->completion); kfree(fwctx); } -@@ -612,6 +615,8 @@ int brcmf_fw_get_firmwares(struct device - struct brcmf_fw_request *req)) +@@ -598,6 +601,7 @@ int brcmf_fw_get_firmwares(struct device { + struct brcmf_fw_item *first = &req->items[0]; struct brcmf_fw *fwctx; + struct completion completion; -+ int err; + int ret; brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev)); - if (!fw_cb) -@@ -628,7 +633,14 @@ int brcmf_fw_get_firmwares(struct device +@@ -615,12 +619,17 @@ int brcmf_fw_get_firmwares(struct device fwctx->req = req; fwctx->done = fw_cb; + init_completion(&completion); + fwctx->completion = &completion; + - brcmf_fw_request_next_item(fwctx, true); -+ -+ wait_for_completion_timeout(fwctx->completion, msecs_to_jiffies(5000)); -+ fwctx->completion = NULL; + ret = request_firmware_nowait(THIS_MODULE, true, first->path, + fwctx->dev, GFP_KERNEL, fwctx, + brcmf_fw_request_done); + if (ret < 0) + brcmf_fw_request_done(NULL, fwctx); + ++ wait_for_completion_timeout(&completion, msecs_to_jiffies(5000)); + return 0; } |