summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/ath/ath9k
Commit message (Collapse)AuthorAgeFilesLines
* treewide: kmalloc() -> kmalloc_array()Kees Cook2018-06-122-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The kmalloc() function has a 2-factor argument form, kmalloc_array(). This patch replaces cases of: kmalloc(a * b, gfp) with: kmalloc_array(a * b, gfp) as well as handling cases of: kmalloc(a * b * c, gfp) with: kmalloc(array3_size(a, b, c), gfp) as it's slightly less ugly than: kmalloc_array(array_size(a, b), c, gfp) This does, however, attempt to ignore constant size factors like: kmalloc(4 * 1024, gfp) though any constants defined via macros get caught up in the conversion. Any factors with a sizeof() of "unsigned char", "char", and "u8" were dropped, since they're redundant. The tools/ directory was manually excluded, since it has its own implementation of kmalloc(). The Coccinelle script used for this was: // Fix redundant parens around sizeof(). @@ type TYPE; expression THING, E; @@ ( kmalloc( - (sizeof(TYPE)) * E + sizeof(TYPE) * E , ...) | kmalloc( - (sizeof(THING)) * E + sizeof(THING) * E , ...) ) // Drop single-byte sizes and redundant parens. @@ expression COUNT; typedef u8; typedef __u8; @@ ( kmalloc( - sizeof(u8) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(__u8) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(char) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(unsigned char) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(u8) * COUNT + COUNT , ...) | kmalloc( - sizeof(__u8) * COUNT + COUNT , ...) | kmalloc( - sizeof(char) * COUNT + COUNT , ...) | kmalloc( - sizeof(unsigned char) * COUNT + COUNT , ...) ) // 2-factor product with sizeof(type/expression) and identifier or constant. @@ type TYPE; expression THING; identifier COUNT_ID; constant COUNT_CONST; @@ ( - kmalloc + kmalloc_array ( - sizeof(TYPE) * (COUNT_ID) + COUNT_ID, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * COUNT_ID + COUNT_ID, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * (COUNT_CONST) + COUNT_CONST, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * COUNT_CONST + COUNT_CONST, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (COUNT_ID) + COUNT_ID, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * COUNT_ID + COUNT_ID, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (COUNT_CONST) + COUNT_CONST, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * COUNT_CONST + COUNT_CONST, sizeof(THING) , ...) ) // 2-factor product, only identifiers. @@ identifier SIZE, COUNT; @@ - kmalloc + kmalloc_array ( - SIZE * COUNT + COUNT, SIZE , ...) // 3-factor product with 1 sizeof(type) or sizeof(expression), with // redundant parens removed. @@ expression THING; identifier STRIDE, COUNT; type TYPE; @@ ( kmalloc( - sizeof(TYPE) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(THING) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) ) // 3-factor product with 2 sizeof(variable), with redundant parens removed. @@ expression THING1, THING2; identifier COUNT; type TYPE1, TYPE2; @@ ( kmalloc( - sizeof(TYPE1) * sizeof(TYPE2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kmalloc( - sizeof(THING1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kmalloc( - sizeof(THING1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) ) // 3-factor product, only identifiers, with redundant parens removed. @@ identifier STRIDE, SIZE, COUNT; @@ ( kmalloc( - (COUNT) * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) ) // Any remaining multi-factor products, first at least 3-factor products, // when they're not all constants... @@ expression E1, E2, E3; constant C1, C2, C3; @@ ( kmalloc(C1 * C2 * C3, ...) | kmalloc( - (E1) * E2 * E3 + array3_size(E1, E2, E3) , ...) | kmalloc( - (E1) * (E2) * E3 + array3_size(E1, E2, E3) , ...) | kmalloc( - (E1) * (E2) * (E3) + array3_size(E1, E2, E3) , ...) | kmalloc( - E1 * E2 * E3 + array3_size(E1, E2, E3) , ...) ) // And then all remaining 2 factors products when they're not all constants, // keeping sizeof() as the second factor argument. @@ expression THING, E1, E2; type TYPE; constant C1, C2, C3; @@ ( kmalloc(sizeof(THING) * C2, ...) | kmalloc(sizeof(TYPE) * C2, ...) | kmalloc(C1 * C2 * C3, ...) | kmalloc(C1 * C2, ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * (E2) + E2, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * E2 + E2, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (E2) + E2, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * E2 + E2, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - (E1) * E2 + E1, E2 , ...) | - kmalloc + kmalloc_array ( - (E1) * (E2) + E1, E2 , ...) | - kmalloc + kmalloc_array ( - E1 * E2 + E1, E2 , ...) ) Signed-off-by: Kees Cook <keescook@chromium.org>
* Merge tag 'wireless-drivers-next-for-davem-2018-05-31' of ↵David S. Miller2018-06-031-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.18 Hopefully the last pull request to 4.18 before the merge window. Nothing major here, we have smaller new features and of course a lots of fixes. Major changes: ath10k * add memory dump support for QCA9888 and QCA99X0 * add support to configure channel dwell time * support new DFS host confirmation feature in the firmware ath * update various regulatory mappings wcn36xx * various fixes to improve reliability * add Factory Test Mode support brmfmac * add debugfs file for reading firmware capabilities mwifiex * support sysfs initiated device coredump ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * ath: add support to get the detected radar specificationsSriram R2018-05-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This enables ath10k/ath9k drivers to collect the specifications of the radar type once it is detected by the dfs pattern detector unit. Usage of the collected info is specific to driver implementation. For example, collected radar info could be used by the host driver to send to co-processors for additional processing/validation. Note: 'radar_detector_specs' data containing the specifications of different radar types which was private within dfs_pattern_detector/ dfs_pri_detector is now shared with drivers as well for making use of this information. Signed-off-by: Sriram R <srirrama@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mac80211: Support adding duration for prepare_tx() callbackIlan Peer2018-05-231-1/+2
|/ | | | | | | | | | | | | | | | | | | There are specific cases, such as SAE authentication exchange, that might require long duration to complete. For such cases, add support for indicating to the driver the required duration of the prepare_tx() operation, so the driver would still be able to complete the frame exchange. Currently, indicate the duration only for SAE authentication exchange, as SAE authentication can take up to 2000 msec (as defined in IEEE P802.11-REVmd D1.0 p. 3504). As the patch modified the prepare_tx() callback API, also modify the relevant code in iwlwifi. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo2018-04-251-3/+3
|\ | | | | | | | | | | | | | | | | | | | | | | ath.git patches for 4.18. Major changes: ath10k * enable temperature reads for QCA6174 and QCA9377 * add firmware memory dump support for QCA9984 * continue adding WCN3990 support via SNOC bus
| * ath9k: dfs: remove accidental use of stack VLAGustavo A. R. Silva2018-04-101-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation to enabling -Wvla, remove accidental use of stack VLA. This avoids an accidental stack VLA (since the compiler thinks the value of FFT_NUM_SAMPLES can change, even when marked "const"). This just replaces it with a #define. Also, fixed as part of the directive to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621 Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | Merge branch 'for-linus' of ↵Linus Torvalds2018-04-051-1/+1
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial Pull trivial tree updates from Jiri Kosina. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: kfifo: fix inaccurate comment tools/thermal: tmon: fix for segfault net: Spelling s/stucture/structure/ edd: don't spam log if no EDD information is present Documentation: Fix early-microcode.txt references after file rename tracing: Block comments should align the * on each line treewide: Fix typos in printk GenWQE: Fix a typo in two comments treewide: Align function definition open/close braces
| * treewide: Align function definition open/close bracesJoe Perches2018-03-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some functions definitions have either the initial open brace and/or the closing brace outside of column 1. Move those braces to column 1. This allows various function analyzers like gnu complexity to work properly for these modified functions. Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com> Acked-by: Paul Moore <paul@paul-moore.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Acked-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Acked-by: Martin K. Petersen <martin.petersen@oracle.com> Acked-by: Takashi Iwai <tiwai@suse.de> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Nicolin Chen <nicoleotsuka@gmail.com> Acked-by: Martin K. Petersen <martin.petersen@oracle.com> Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | ath: Remove unnecessary ath_bcast_mac and use eth_broadcast_addrJoe Perches2018-03-292-2/+2
| | | | | | | | | | | | | | | | Remove the static array and use the generic routine to set the Ethernet broadcast address. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | ath9k: fix DFS detector synchronizationTimothy Redaelli2018-03-291-4/+5
| | | | | | | | | | | | | | | | | | | | | | some userspace programs (e.g. hostapd) need to set the regulatory domain before selecting the operating channel. Synchronize DFS detector regardless of the value of ah->curchan, to avoid situations where wireless scan can't be done on some 5GHz sub-bands, because dfs_region is constantly UNSET. Acked-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | wireless: Use octal not symbolic permissionsJoe Perches2018-03-277-46/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Prefer the direct use of octal for permissions. Done with checkpatch -f --types=SYMBOLIC_PERMS --fix-inplace and some typing. Miscellanea: o Whitespace neatening around these conversions. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo2018-03-274-9/+23
|\ \ | | | | | | | | | | | | | | | | | | | | | ath.git patches for 4.17. Major changes: wil6210 * support multiple virtual interfaces
| * | ath9k: spelling s/premble/preamble/Peter Große2018-03-261-1/+1
| | | | | | | | | | | | | | | Signed-off-by: Peter Große <pegro@friiks.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
| * | ath9k: fix crash in spectral scanSebastian Gottschall2018-03-261-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes crash seen on arm smp systems (gateworks ventana imx6): Unable to handle kernel NULL pointer dereference at virtual address 00000014 pgd = 80004000 [00000014] *pgd=00000000 Internal error: Oops - BUG: 17 [#1] PREEMPT SMP ARM Modules linked in: ip6table_filter nf_conntrack_ipv6 ip6_tables nf_log_ipv6 nf_defrag_ipv6 shortcut_fe ipcomp6 xfrm_ipcomp xfrm6_tunnel xfrm6_mode_tunnel xfrm6_mode_transport xfrm6_mode_ro xfrm6_mode_beet ip6_tunnel tunnel6 mip6 ah6 esp6 xfrm_algo sit ip_tunnel tunnel4 ipv6 ath10k_pci ath10k_core ath9k ath mac80211 cfg80211 compat ath_pci ath_hal(P) caamalg authencesn authenc caamrng caamhash caam_jr caam cdc_ncm usbnet usbcore sky2 imx2_wdt CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: P 4.9.85 #19 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) task: bf064980 task.stack: bf07c000 PC is at relay_buf_full+0xc/0x30 LR is at _674+0x740/0xf10 [ath9k] pc : [<8018bce0>] lr : [<7f1aa604>] psr: 80000013 sp : bf07dbf0 ip : bf07dc00 fp : bf07dbfc r10: 0000003f r9 : bf130e00 r8 : 809044b0 r7 : 00000000 r6 : be67a9f0 r5 : 00000000 r4 : 809043e4 r3 : c0864c24 r2 : 00000000 r1 : 00000004 r0 : 00000000 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 10c5387d Table: 4e6a004a DAC: 00000055 Process ksoftirqd/0 (pid: 3, stack limit = 0xbf07c210) Stack: (0xbf07dbf0 to 0xbf07e000) dbe0: bf07dd04 bf07dc00 7f1aa604 8018bce0 dc00: 00004014 be59e010 bf07dc34 bf07dc18 7f1a7084 7f19c07c be59c010 be6470a0 dc20: 0000096c be648954 bf07dc6c bf07dc38 7f1c286c bf07dd90 bf07dc5c bf07dc48 dc40: 8029ea4c 0000003c 00000001 be59c010 00000094 00000000 00000000 00000000 dc60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dca0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dcc0: 00000000 00000000 00000000 00000000 00000000 00000000 8010ef24 00000030 dce0: be94f5e8 be6485a0 bddf0200 be59c010 be6465a0 be6415a0 bf07ddf4 bf07dd08 dd00: 7f1cf800 7f1aa55c 1fc38c4c 00000000 bf07dd58 cccccccd 66666667 be640bc0 dd20: bf07dd54 be6415a0 1fc38c4c 00000000 00000000 be59c038 be67a9c0 be59e010 dd40: be67a9f0 be647170 8090c904 be59c010 00000000 00000001 1fc38e84 00000000 dd60: be640bc0 bddf0200 00000200 00000010 0000003f 00000002 20000013 be59c010 dd80: 8092d940 bf7ca2c0 bf07ddb4 bf07dd98 1fc38c4c 2602003f 0100ff1b 80ff1b00 dda0: 00808080 00000000 00000000 80808080 80808080 80808080 80808080 00008080 ddc0: 00000000 00000000 7f1b62b8 00000002 be6470ec be6470f0 00000000 bf07de98 dde0: 8092d940 be6415a0 bf07de94 bf07ddf8 7f1d1ed8 7f1cf1fc 00000000 00000000 de00: bf7cc4c0 00000400 be6470f0 bf07de18 8015165c be59c010 8090453c 8090453c de20: bf07dec4 be6465a0 8014f614 80148884 0000619a 00000001 bf07c000 00000100 de40: bf07de78 00000001 7f327850 00000002 afb50401 bf064980 bf07de9c bf07de68 de60: bf064a00 803cc668 bf064a00 be6470b4 be6470b8 80844180 00000000 bf07de98 de80: 8092d940 bf07c000 bf07dec4 bf07de98 80124d18 7f1d1c44 80124c94 00000000 dea0: 00000006 80902098 80902080 40000006 00000100 bf07c000 bf07df24 bf07dec8 dec0: 8012501c 80124ca0 bf7cc4c0 bf064980 be95e1c0 04208040 80902d00 000061c7 dee0: 0000000a 80600b54 8092d940 808441f8 80902080 bf07dec8 bf03b200 bf07c000 df00: bf03b200 8090fe54 00000000 00000000 00000000 00000000 bf07df34 bf07df28 df20: 80125148 80124f28 bf07df5c bf07df38 8013deb4 8012511c 00000000 bf03b240 df40: bf03b200 8013dc90 00000000 00000000 bf07dfac bf07df60 8013ad40 8013dc9c df60: 70448040 00000001 00000000 bf03b200 00000000 00030003 bf07df78 bf07df78 df80: 00000000 00000000 bf07df88 bf07df88 bf03b240 8013ac48 00000000 00000000 dfa0: 00000000 bf07dfb0 80107760 8013ac54 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 8c120004 1190ad04 Backtrace: [<8018bcd4>] (relay_buf_full) from [<7f1aa604>] (_674+0x740/0xf10 [ath9k]) [<7f1aa550>] (_674 [ath9k]) from [<7f1cf800>] (_582+0x14b4/0x3708 [ath9k]) r10:be6415a0 r9:be6465a0 r8:be59c010 r7:bddf0200 r6:be6485a0 r5:be94f5e8 r4:00000030 [<7f1cf1f0>] (_582 [ath9k]) from [<7f1d1ed8>] (_735+0x2a0/0xec4 [ath9k]) r10:be6415a0 r9:8092d940 r8:bf07de98 r7:00000000 r6:be6470f0 r5:be6470ec r4:00000002 [<7f1d1c38>] (_735 [ath9k]) from [<80124d18>] (tasklet_action+0x84/0xf8) r10:bf07c000 r9:8092d940 r8:bf07de98 r7:00000000 r6:80844180 r5:be6470b8 r4:be6470b4 [<80124c94>] (tasklet_action) from [<8012501c>] (__do_softirq+0x100/0x1f4) r10:bf07c000 r9:00000100 r8:40000006 r7:80902080 r6:80902098 r5:00000006 r4:00000000 r3:80124c94 [<80124f1c>] (__do_softirq) from [<80125148>] (run_ksoftirqd+0x38/0x4c) r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:8090fe54 r5:bf03b200 r4:bf07c000 [<80125110>] (run_ksoftirqd) from [<8013deb4>] (smpboot_thread_fn+0x224/0x260) [<8013dc90>] (smpboot_thread_fn) from [<8013ad40>] (kthread+0xf8/0x100) r9:00000000 r8:00000000 r7:8013dc90 r6:bf03b200 r5:bf03b240 r4:00000000 [<8013ac48>] (kthread) from [<80107760>] (ret_from_fork+0x14/0x34) r7:00000000 r6:00000000 r5:8013ac48 r4:bf03b240 Code: e89da800 e1a0c00d e92dd800 e24cb004 (e5901014) ---[ end trace dddf11ac9111b272 ]--- Kernel panic - not syncing: Fatal exception in interrupt CPU1: stopping CPU: 1 PID: 0 Comm: swapper/1 Tainted: P D 4.9.85 #19 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Backtrace: [<8010a708>] (dump_backtrace) from [<8010a99c>] (show_stack+0x18/0x1c) r7:bf093f58 r6:20000193 r5:809168e8 r4:00000000 [<8010a984>] (show_stack) from [<802a09c4>] (dump_stack+0x94/0xa8) [<802a0930>] (dump_stack) from [<8010d184>] (handle_IPI+0xe8/0x180) r7:bf093f58 r6:00000000 r5:00000001 r4:808478c4 [<8010d09c>] (handle_IPI) from [<801013e8>] (gic_handle_irq+0x78/0x7c) r7:f4000100 r6:bf093f58 r5:f400010c r4:8090467c [<80101370>] (gic_handle_irq) from [<8010b378>] (__irq_svc+0x58/0x8c) Exception stack(0xbf093f58 to 0xbf093fa0) 3f40: bf7d62a0 00000000 3f60: 0010a5f4 80113460 bf092000 809043e4 00000002 80904434 bf092008 412fc09a 3f80: 00000000 bf093fb4 bf093fb8 bf093fa8 8010804c 80108050 60000013 ffffffff r9:bf092000 r8:bf092008 r7:bf093f8c r6:ffffffff r5:60000013 r4:80108050 [<80108014>] (arch_cpu_idle) from [<80553c2c>] (default_idle_call+0x30/0x34) [<80553bfc>] (default_idle_call) from [<80158394>] (cpu_startup_entry+0xc4/0xfc) [<801582d0>] (cpu_startup_entry) from [<8010ce40>] (secondary_start_kernel+0x168/0x174) r7:8092d2f8 r4:80913568 [<8010ccd8>] (secondary_start_kernel) from [<10101488>] (0x10101488) r5:00000055 r4:4f07806a Rebooting in 10 seconds.. Reboot failed -- System halted Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
| * | ath9k: Protect queue draining by rcu_read_lock()Toke Høiland-Jørgensen2018-03-141-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When ath9k was switched over to use the mac80211 intermediate queues, node cleanup now drains the mac80211 queues. However, this call path is not protected by rcu_read_lock() as it was previously entirely internal to the driver which uses its own locking. This leads to a possible rcu_dereference() without holding rcu_read_lock(); but only if a station is cleaned up while having packets queued on the TXQ. Fix this by adding the rcu_read_lock() to the caller in ath9k. Fixes: 50f08edf9809 ("ath9k: Switch to using mac80211 intermediate software queues.") Cc: stable@vger.kernel.org Reported-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
| * | ath9k: Fix ack SIFS time for quarter/half channelsWojciech Dubowik2018-02-271-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ack timing generation has to be adapted for 5/10 MHz channels. Do it by properly initializing ack shift field in TXSIFS register. Ack shift assumes channel width of 2.5 Mhz so value zero means 2.5 MHz, 1 is 5 MHz and so on. Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
| * | ath9k: Fix airtime calculation for quarter/half channelsWojciech Dubowik2018-02-271-2/+4
| |/ | | | | | | | | | | | | | | | | The bitrate value for airtime calculation is specified for full rates. We need to divide it for 5 and 10MHz channels to get correct result. Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | ath9k_htc: use non-QoS NDP for AP probingJohannes Berg2018-03-211-0/+1
|/ | | | | | | | | | | | | | When switching mac80211 to use QoS NDP, it turned out that ath9k_htc is somehow broken by this, e.g. see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891060. Fix this by using the new mac80211 flag to go back to the old, incorrect, behaviour for this driver. Fixes: 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing") Reported-by: Ben Caradoc-Davies <ben@transient.nz> Acked-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* ath9k_htc: add Altai WA1011N-GUOleksij Rempel2018-02-071-0/+1
| | | | | | | | as reported in: https://github.com/qca/open-ath9k-htc-firmware/pull/71#issuecomment-361100070 Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k: Fix get channel default noise floorWojciech Dubowik2018-02-071-1/+1
| | | | | | | | | | | | | Commit 8da58553cc63 ("ath9k: Use calibrated noise floor value when available") introduced regression in ath9k_hw_getchan_noise where per chain nominal noise floor has been taken instead default for channel. Revert to original default channel noise floor. Fixes: 8da58553cc63 ("ath9k: Use calibrated noise floor value when available") Reported-by: Sebastian Gottschall <s.gottschall@dd-wrt.com> Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k: Display calibration data piers in debugfsWojciech Dubowik2018-01-251-1/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Display per frequency calibration data in dump_modal debugfs entry including reference power, voltage, tx temperature and noise floor. Example of chain 0 of OEM card (dump from modal_eeprom): Chain 0 Freq ref volt temp nf_Cal nf_Pow rx_temp 5180 -30 0 137 0 0 0 5320 -24 0 137 0 0 0 5500 -15 0 137 0 0 0 5620 -10 0 137 0 0 0 5700 -15 0 137 0 0 0 5745 -16 0 135 0 0 0 5785 -19 0 136 0 0 0 5825 -22 0 136 0 0 0 Example of a card with calibrated noise floor. Chain 0 Freq ref volt temp nf_Cal nf_Pow rx_temp 4890 -49 0 128 -107 -97 124 5100 -23 0 128 -101 -96 124 5180 -18 0 128 -101 -96 124 5300 -12 0 128 -102 -97 124 5500 -9 0 128 -101 -97 125 5640 -17 0 128 -101 -98 124 5785 -25 0 128 -101 -98 124 5940 -33 0 128 -106 -99 124 Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k: Use calibrated noise floor value when availableWojciech Dubowik2018-01-251-14/+24
| | | | | | | | | | | | | | AR9003 series allows to calibrate noise floor for different frequency bins. Once it's done it's possible to get more accurate rssi/signal values over whole frequency band at a given temperature. The RSSI/signal accuracy reported by calibrated RF cards improves from 6 to up to 2dB. This could be interesting for application which require good signal accuracy like roaming or mesh protocols. Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k: Read noise floor calibration data from eepromWojciech Dubowik2018-01-253-8/+67
| | | | | | | | | | AR9003 devices can have calibrated noise floor values which can be used instead of hard coded one. Read them from eeprom and save interpolated value in nf limits for the current channel. Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k: Alternative EEPROM size for AR9003Wojciech Dubowik2018-01-251-0/+6
| | | | | | | | | | | AR9003 factory calibration allows to use bigger EEPROM than standard 1k without changing the default layout. Allow probing of EEPROM at alternative address if initial check for default fails. The original ar9003 eeprom ops are still be used. Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k: discard undersized packetsFelix Fietkau2018-01-251-2/+2
| | | | | | | | | Sometimes the hardware will push small packets that trigger a WARN_ON in mac80211. Discard them early to avoid this issue. Reported-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k: add a quirk to set use_msi automaticallyAceLan Kao2018-01-161-0/+53
| | | | | | | | | | | | | | | Some platform(BIOS) blocks legacy interrupts (INTx), and only allows MSI for WLAN device. So adding a quirk to list those machines and set use_msi automatically. Adding the following platforms to the quirk. Dell Inspiron 24-3460 Dell Inspiron 3472 Dell Inspiron 14-3473 Dell Vostro 3262 Dell Vostro 15-3572 Signed-off-by: AceLan Kao <acelan.kao@canonical.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k: add MSI supportRussell Hu2018-01-166-8/+115
| | | | | | | | | | | On new Intel platforms like ApolloLake, legacy interrupt mechanism (INTx) is not supported, so WLAN modules are not working because interrupts are missing, therefore this patch is to add MSI support to ath9k. With module paremeter "use_msi=1", ath9k driver would try to use MSI instead of INTx. Signed-off-by: Russell Hu <rhu@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ath9k_htc: Add a sanity check in ath9k_htc_ampdu_action()Dan Carpenter2017-12-141-0/+4
| | | | | | | | | | | | | | | Smatch generates a warning here: drivers/net/wireless/ath/ath9k/htc_drv_main.c:1688 ath9k_htc_ampdu_action() error: buffer overflow 'ista->tid_state' 8 <= 15 I don't know if it's a real bug or not but the other paths through this function all ensure that "tid" is less than ATH9K_HTC_MAX_TID (8) so checking here makes things more consistent. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: move spectral scan support under a separate config symbolMatthias Schiffer2017-12-073-8/+14
| | | | | | | | | | | | | At the moment, spectral scan support, and with it RELAY, is always enabled with ATH9K[_HTC]_DEBUGFS. Spectral scan support is currently the only user of RELAY in ath9k, and it unconditionally reserves a relay channel. Having debugfs support in ath9k is often useful even on very small embedded routers, where we'd rather like to avoid the code size and RAM usage of the relay support. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: dfs: use swap macro in ath9k_check_chirpingGustavo A. R. Silva2017-12-021-5/+3
| | | | | | | | | | Make use of the swap macro and remove unnecessary variable temp. This makes the code easier to read and maintain. This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* mac80211: use QoS NDP for AP probingJohannes Berg2017-11-271-1/+1
| | | | | | | | | | When connected to a QoS/WMM AP, mac80211 should use a QoS NDP for probing it, instead of a regular non-QoS one, fix this. Change all the drivers to *not* allow QoS NDP for now, even though it looks like most of them should be OK with that. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* Merge tag 'wireless-drivers-next-for-davem-2017-11-03' of ↵David S. Miller2017-11-0419-78/+80
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.15 Mostly fixes this time, but also few new features. Major changes: wil6210 * remove ssid debugfs file rsi * add WOWLAN support for suspend, hibernate and shutdown states ath10k * add support for CCMP-256, GCMP and GCMP-256 ciphers on hardware where it's supported (QCA99x0 and QCA4019) ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * ath: Convert timers to use timer_setup()Kees Cook2017-10-279-30/+25
| | | | | | | | | | | | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Kalle Valo <kvalo@qca.qualcomm.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: debug: Remove redundant checkChristos Gkekas2017-10-271-1/+1
| | | | | | | | | | | | | | | | Variable val is unsigned, so checking whether it is less than zero is redundant. Signed-off-by: Christos Gkekas <chris.gekas@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: fix tx99 potential info leakMiaoqing Pan2017-10-131-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | When the user sets count to zero the string buffer would remain completely uninitialized which causes the kernel to parse its own stack data, potentially leading to an info leak. In addition to that, the string might be not terminated properly when the user data does not contain a 0-terminator. Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> Reviewed-by: Christoph Böhmwalder <christoph@boehmwalder.at> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: make const array reg_hole_list static, reduces object code sizeColin Ian King2017-10-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't populate the read-only array reg_hole_list on the stack, instead make it static. Makes the object code smaller by over 200 bytes: Before: text data bss dec hex filename 57518 15248 0 72766 11c3e debug.o After: text data bss dec hex filename 57218 15344 0 72562 11b72 debug.o Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: Avoid a potential deadlockVille Syrjälä2017-09-253-11/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Lockdep warns us that sc_pm_lock and cc_lock can cause a deadlock when cc_lock is acquired by itself with interrupts enabled. Disable irqs whenever taking cc_lock to avoid this. [ 19.094524] kworker/u2:0/5 just changed the state of lock: [ 19.094578] (&(&sc->sc_pm_lock)->rlock){-.-...}, at: [<f836c00e>] ath_isr+0x15e/0x200 [ath9k] [ 19.094674] but this lock took another, HARDIRQ-unsafe lock in the past: [ 19.094731] (&(&common->cc_lock)->rlock){+.-...} [ 19.094741] and interrupts could create inverse lock ordering between them. [ 19.094866] other info that might help us debug this: [ 19.094926] Possible interrupt unsafe locking scenario: [ 19.094985] CPU0 CPU1 [ 19.095036] ---- ---- [ 19.095086] lock(&(&common->cc_lock)->rlock); [ 19.095197] local_irq_disable(); [ 19.095305] lock(&(&sc->sc_pm_lock)->rlock); [ 19.095423] lock(&(&common->cc_lock)->rlock); [ 19.095539] <Interrupt> [ 19.095636] lock(&(&sc->sc_pm_lock)->rlock); [ 19.095745] *** DEADLOCK *** [ 19.095965] 3 locks held by kworker/u2:0/5: [ 19.096067] #0: ("%s"wiphy_name(local->hw.wiphy)){.+.+.+}, at: [<c1067f37>] process_one_work+0x127/0x580 [ 19.096260] #1: ((&local->dynamic_ps_enable_work)){+.+...}, at: [<c1067f37>] process_one_work+0x127/0x580 [ 19.096447] #2: (&sc->mutex){+.+...}, at: [<f836b8b0>] ath9k_config+0x30/0x1d0 [ath9k] [ 19.096639] the shortest dependencies between 2nd lock and 1st lock: [ 19.096813] -> (&(&common->cc_lock)->rlock){+.-...} ops: 38 { [ 19.096816] HARDIRQ-ON-W at: [ 19.096816] __lock_acquire+0x57e/0x1260 [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] _raw_spin_lock_bh+0x3f/0x50 [ 19.096816] ath_chanctx_set_channel+0xb6/0x2c0 [ath9k] [ 19.096816] ath9k_config+0xa8/0x1d0 [ath9k] [ 19.096816] ieee80211_hw_config+0xa8/0x5f0 [mac80211] [ 19.096816] ieee80211_do_open+0x67a/0x920 [mac80211] [ 19.096816] ieee80211_open+0x41/0x50 [mac80211] [ 19.096816] __dev_open+0xab/0x140 [ 19.096816] __dev_change_flags+0x89/0x150 [ 19.096816] dev_change_flags+0x28/0x60 [ 19.096816] do_setlink+0x290/0x890 [ 19.096816] rtnl_newlink+0x7cf/0x8e0 [ 19.096816] rtnetlink_rcv_msg+0xbf/0x1f0 [ 19.096816] netlink_rcv_skb+0xb9/0xe0 [ 19.096816] rtnetlink_rcv+0x1e/0x30 [ 19.096816] netlink_unicast+0x13a/0x2c0 [ 19.096816] netlink_sendmsg+0x290/0x380 [ 19.096816] ___sys_sendmsg+0x1e2/0x280 [ 19.096816] __sys_sendmsg+0x3f/0x80 [ 19.096816] SyS_socketcall+0x58c/0x6b0 [ 19.096816] do_fast_syscall_32+0x96/0x1d0 [ 19.096816] entry_SYSENTER_32+0x4c/0x7b [ 19.096816] IN-SOFTIRQ-W at: [ 19.096816] __lock_acquire+0x55a/0x1260 [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] _raw_spin_lock+0x3c/0x50 [ 19.096816] ath_ps_full_sleep+0x24/0x70 [ath9k] [ 19.096816] call_timer_fn+0xa4/0x300 [ 19.096816] run_timer_softirq+0x1b1/0x560 [ 19.096816] __do_softirq+0xb0/0x430 [ 19.096816] do_softirq_own_stack+0x33/0x40 [ 19.096816] irq_exit+0xad/0xc0 [ 19.096816] smp_apic_timer_interrupt+0x31/0x40 [ 19.096816] apic_timer_interrupt+0x37/0x3c [ 19.096816] wp_page_copy+0xb8/0x580 [ 19.096816] do_wp_page+0x64/0x420 [ 19.096816] handle_mm_fault+0x430/0x990 [ 19.096816] __do_page_fault+0x18b/0x430 [ 19.096816] do_page_fault+0xb/0x10 [ 19.096816] common_exception+0x62/0x6a [ 19.096816] INITIAL USE at: [ 19.096816] __lock_acquire+0x204/0x1260 [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] _raw_spin_lock_bh+0x3f/0x50 [ 19.096816] ath_chanctx_set_channel+0xb6/0x2c0 [ath9k] [ 19.096816] ath9k_config+0xa8/0x1d0 [ath9k] [ 19.096816] ieee80211_hw_config+0xa8/0x5f0 [mac80211] [ 19.096816] ieee80211_do_open+0x67a/0x920 [mac80211] [ 19.096816] ieee80211_open+0x41/0x50 [mac80211] [ 19.096816] __dev_open+0xab/0x140 [ 19.096816] __dev_change_flags+0x89/0x150 [ 19.096816] dev_change_flags+0x28/0x60 [ 19.096816] do_setlink+0x290/0x890 [ 19.096816] rtnl_newlink+0x7cf/0x8e0 [ 19.096816] rtnetlink_rcv_msg+0xbf/0x1f0 [ 19.096816] netlink_rcv_skb+0xb9/0xe0 [ 19.096816] rtnetlink_rcv+0x1e/0x30 [ 19.096816] netlink_unicast+0x13a/0x2c0 [ 19.096816] netlink_sendmsg+0x290/0x380 [ 19.096816] ___sys_sendmsg+0x1e2/0x280 [ 19.096816] __sys_sendmsg+0x3f/0x80 [ 19.096816] SyS_socketcall+0x58c/0x6b0 [ 19.096816] do_fast_syscall_32+0x96/0x1d0 [ 19.096816] entry_SYSENTER_32+0x4c/0x7b [ 19.096816] } [ 19.096816] ... key at: [<f837b694>] __key.61991+0x0/0xffffc96c [ath9k] [ 19.096816] ... acquired at: [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] _raw_spin_lock+0x3c/0x50 [ 19.096816] ath9k_ps_wakeup+0x85/0xe0 [ath9k] [ 19.096816] ath9k_bss_info_changed+0x2a/0x1b0 [ath9k] [ 19.096816] ieee80211_bss_info_change_notify+0xf3/0x360 [mac80211] [ 19.096816] ieee80211_recalc_txpower+0x33/0x40 [mac80211] [ 19.096816] ieee80211_set_tx_power+0x45/0x1d0 [mac80211] [ 19.096816] cfg80211_wext_siwtxpower+0xd3/0x350 [cfg80211] [ 19.096816] ioctl_standard_call+0x4e/0x400 [ 19.096816] wext_handle_ioctl+0xf4/0x190 [ 19.096816] dev_ioctl+0xb7/0x630 [ 19.096816] sock_ioctl+0x13e/0x2d0 [ 19.096816] do_vfs_ioctl+0x84/0x750 [ 19.096816] SyS_ioctl+0x34/0x60 [ 19.096816] do_fast_syscall_32+0x96/0x1d0 [ 19.096816] entry_SYSENTER_32+0x4c/0x7b [ 19.096816] -> (&(&sc->sc_pm_lock)->rlock){-.-...} ops: 597 { [ 19.096816] IN-HARDIRQ-W at: [ 19.096816] __lock_acquire+0x6ae/0x1260 [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] _raw_spin_lock_irqsave+0x45/0x60 [ 19.096816] ath_isr+0x15e/0x200 [ath9k] [ 19.096816] __handle_irq_event_percpu+0x44/0x340 [ 19.096816] handle_irq_event_percpu+0x1d/0x50 [ 19.096816] handle_irq_event+0x32/0x60 [ 19.096816] handle_level_irq+0x81/0x100 [ 19.096816] handle_irq+0x9c/0xd0 [ 19.096816] do_IRQ+0x5c/0x120 [ 19.096816] common_interrupt+0x36/0x3c [ 19.096816] _raw_spin_unlock_irqrestore+0x57/0x70 [ 19.096816] ath9k_config+0x16a/0x1d0 [ath9k] [ 19.096816] ieee80211_hw_config+0xa8/0x5f0 [mac80211] [ 19.096816] ieee80211_dynamic_ps_enable_work+0x1c3/0x680 [mac80211] [ 19.096816] process_one_work+0x1d1/0x580 [ 19.096816] worker_thread+0x31/0x380 [ 19.096816] kthread+0xd9/0x110 [ 19.096816] ret_from_fork+0x19/0x24 [ 19.096816] IN-SOFTIRQ-W at: [ 19.096816] __lock_acquire+0x55a/0x1260 [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] _raw_spin_lock_irqsave+0x45/0x60 [ 19.096816] ath9k_ps_wakeup+0x24/0xe0 [ath9k] [ 19.096816] ath9k_tasklet+0x42/0x260 [ath9k] [ 19.096816] tasklet_action+0x196/0x1e0 [ 19.096816] __do_softirq+0xb0/0x430 [ 19.096816] do_softirq_own_stack+0x33/0x40 [ 19.096816] irq_exit+0xad/0xc0 [ 19.096816] do_IRQ+0x65/0x120 [ 19.096816] common_interrupt+0x36/0x3c [ 19.096816] get_page_from_freelist+0x20a/0x970 [ 19.096816] __alloc_pages_nodemask+0xca/0xed0 [ 19.096816] __get_free_pages+0x14/0x30 [ 19.096816] pgd_alloc+0x1d/0x160 [ 19.096816] mm_init.isra.47+0x13a/0x1b0 [ 19.096816] copy_process.part.54+0xb55/0x1700 [ 19.096816] _do_fork+0xd4/0x6a0 [ 19.096816] SyS_clone+0x27/0x30 [ 19.096816] do_fast_syscall_32+0x96/0x1d0 [ 19.096816] entry_SYSENTER_32+0x4c/0x7b [ 19.096816] INITIAL USE at: [ 19.096816] __lock_acquire+0x204/0x1260 [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] _raw_spin_lock_irqsave+0x45/0x60 [ 19.096816] ath9k_ps_wakeup+0x24/0xe0 [ath9k] [ 19.096816] ath9k_start+0x29/0x1f0 [ath9k] [ 19.096816] drv_start+0x71/0x270 [mac80211] [ 19.096816] ieee80211_do_open+0x31f/0x920 [mac80211] [ 19.096816] ieee80211_open+0x41/0x50 [mac80211] [ 19.096816] __dev_open+0xab/0x140 [ 19.096816] __dev_change_flags+0x89/0x150 [ 19.096816] dev_change_flags+0x28/0x60 [ 19.096816] do_setlink+0x290/0x890 [ 19.096816] rtnl_newlink+0x7cf/0x8e0 [ 19.096816] rtnetlink_rcv_msg+0xbf/0x1f0 [ 19.096816] netlink_rcv_skb+0xb9/0xe0 [ 19.096816] rtnetlink_rcv+0x1e/0x30 [ 19.096816] netlink_unicast+0x13a/0x2c0 [ 19.096816] netlink_sendmsg+0x290/0x380 [ 19.096816] ___sys_sendmsg+0x1e2/0x280 [ 19.096816] __sys_sendmsg+0x3f/0x80 [ 19.096816] SyS_socketcall+0x58c/0x6b0 [ 19.096816] do_fast_syscall_32+0x96/0x1d0 [ 19.096816] entry_SYSENTER_32+0x4c/0x7b [ 19.096816] } [ 19.096816] ... key at: [<f837b67c>] __key.61994+0x0/0xffffc984 [ath9k] [ 19.096816] ... acquired at: [ 19.096816] check_usage_forwards+0x118/0x120 [ 19.096816] mark_lock+0x2e4/0x590 [ 19.096816] __lock_acquire+0x6ae/0x1260 [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] _raw_spin_lock_irqsave+0x45/0x60 [ 19.096816] ath_isr+0x15e/0x200 [ath9k] [ 19.096816] __handle_irq_event_percpu+0x44/0x340 [ 19.096816] handle_irq_event_percpu+0x1d/0x50 [ 19.096816] handle_irq_event+0x32/0x60 [ 19.096816] handle_level_irq+0x81/0x100 [ 19.096816] handle_irq+0x9c/0xd0 [ 19.096816] do_IRQ+0x5c/0x120 [ 19.096816] common_interrupt+0x36/0x3c [ 19.096816] _raw_spin_unlock_irqrestore+0x57/0x70 [ 19.096816] ath9k_config+0x16a/0x1d0 [ath9k] [ 19.096816] ieee80211_hw_config+0xa8/0x5f0 [mac80211] [ 19.096816] ieee80211_dynamic_ps_enable_work+0x1c3/0x680 [mac80211] [ 19.096816] process_one_work+0x1d1/0x580 [ 19.096816] worker_thread+0x31/0x380 [ 19.096816] kthread+0xd9/0x110 [ 19.096816] ret_from_fork+0x19/0x24 [ 19.096816] stack backtrace: [ 19.096816] CPU: 0 PID: 5 Comm: kworker/u2:0 Not tainted 4.13.0-mgm-ovl+ #51 [ 19.096816] Hardware name: FUJITSU SIEMENS LIFEBOOK S6120/FJNB16C, BIOS Version 1.26 05/10/2004 [ 19.096816] Workqueue: phy0 ieee80211_dynamic_ps_enable_work [mac80211] [ 19.096816] Call Trace: [ 19.096816] <IRQ> [ 19.096816] dump_stack+0x16/0x19 [ 19.096816] print_irq_inversion_bug.part.37+0x16c/0x179 [ 19.096816] check_usage_forwards+0x118/0x120 [ 19.096816] ? ret_from_fork+0x19/0x24 [ 19.096816] ? print_shortest_lock_dependencies+0x1a0/0x1a0 [ 19.096816] mark_lock+0x2e4/0x590 [ 19.096816] ? print_shortest_lock_dependencies+0x1a0/0x1a0 [ 19.096816] __lock_acquire+0x6ae/0x1260 [ 19.096816] lock_acquire+0xb1/0x1c0 [ 19.096816] ? ath_isr+0x15e/0x200 [ath9k] [ 19.096816] _raw_spin_lock_irqsave+0x45/0x60 [ 19.096816] ? ath_isr+0x15e/0x200 [ath9k] [ 19.096816] ath_isr+0x15e/0x200 [ath9k] [ 19.096816] __handle_irq_event_percpu+0x44/0x340 [ 19.096816] handle_irq_event_percpu+0x1d/0x50 [ 19.096816] handle_irq_event+0x32/0x60 [ 19.096816] ? handle_nested_irq+0x100/0x100 [ 19.096816] handle_level_irq+0x81/0x100 [ 19.096816] handle_irq+0x9c/0xd0 [ 19.096816] </IRQ> [ 19.096816] do_IRQ+0x5c/0x120 [ 19.096816] common_interrupt+0x36/0x3c [ 19.096816] EIP: _raw_spin_unlock_irqrestore+0x57/0x70 [ 19.096816] EFLAGS: 00000286 CPU: 0 [ 19.096816] EAX: f60a3600 EBX: 00000286 ECX: 00000006 EDX: 00000001 [ 19.096816] ESI: f46c9e68 EDI: f46c8620 EBP: f60b5e8c ESP: f60b5e84 [ 19.096816] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 [ 19.096816] ath9k_config+0x16a/0x1d0 [ath9k] [ 19.096816] ieee80211_hw_config+0xa8/0x5f0 [mac80211] [ 19.096816] ? ieee80211_hw_config+0x1db/0x5f0 [mac80211] [ 19.096816] ieee80211_dynamic_ps_enable_work+0x1c3/0x680 [mac80211] [ 19.096816] ? process_one_work+0x127/0x580 [ 19.096816] ? process_one_work+0x127/0x580 [ 19.096816] process_one_work+0x1d1/0x580 [ 19.096816] ? process_one_work+0x127/0x580 [ 19.096816] worker_thread+0x31/0x380 [ 19.096816] kthread+0xd9/0x110 [ 19.096816] ? process_one_work+0x580/0x580 [ 19.096816] ? kthread_create_on_node+0x30/0x30 [ 19.096816] ret_from_fork+0x19/0x24 Cc: QCA ath9k Development <ath9k-devel@qca.qualcomm.com> Cc: Kalle Valo <kvalo@codeaurora.org> Cc: netdev@vger.kernel.org Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: Use ARRAY_SIZE macroThomas Meyer2017-09-251-3/+2
| | | | | | | | | | | | | | | | | | | | | | Use ARRAY_SIZE macro, rather than explicitly coding some variant of it yourself. Found with: find -type f -name "*.c" -o -name "*.h" | xargs perl -p -i -e 's/\bsizeof\s*\(\s*(\w+)\s*\)\s*\ /\s*sizeof\s*\(\s*\1\s*\[\s*0\s*\]\s*\) /ARRAY_SIZE(\1)/g' and manual check/verification. Signed-off-by: Thomas Meyer <thomas@m3y3r.de> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: remove cast to void pointerHimanshu Jha2017-09-2511-32/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | casting to void pointer from any pointer type and vice-versa is done implicitly and therefore casting is not needed in such a case. Done using Coccinellle. Semantic Patch used : @r@ expression x; void* e; type T; identifier f; @@ ( *((T *)e) | ((T *)x)[...] | ((T *)x)->f | - (T *) e ) Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* | License cleanup: add SPDX GPL-2.0 license identifier to files with no licenseGreg Kroah-Hartman2017-11-021-0/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many source files in the tree are missing licensing information, which makes it harder for compliance tools to determine the correct license. By default all files without license information are under the default license of the kernel, which is GPL version 2. Update the files which contain no license information with the 'GPL-2.0' SPDX license identifier. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. How this work was done: Patches were generated and checked against linux-4.14-rc6 for a subset of the use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information, Further patches will be generated in subsequent months to fix up cases where non-standard license headers were used, and references to license had to be inferred by heuristics based on keywords. The analysis to determine which SPDX License Identifier to be applied to a file was done in a spreadsheet of side by side results from of the output of two independent scanners (ScanCode & Windriver) producing SPDX tag:value files created by Philippe Ombredanne. Philippe prepared the base worksheet, and did an initial spot review of a few 1000 files. The 4.13 kernel was the starting point of the analysis with 60,537 files assessed. Kate Stewart did a file by file comparison of the scanner results in the spreadsheet to determine which SPDX license identifier(s) to be applied to the file. She confirmed any determination that was not immediately clear with lawyers working with the Linux Foundation. Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines). All documentation files were explicitly excluded. The following heuristics were used to determine which SPDX license identifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time. In total, over 70 hours of logged manual review was done on the spreadsheet to determine the SPDX license identifiers to apply to the source files by Kate, Philippe, Thomas and, in some cases, confirmation by lawyers working with the Linux Foundation. Kate also obtained a third independent scan of the 4.13 code base from FOSSology, and compared selected files where the other two scanners disagreed against that SPDX file, to see if there was new insights. The Windriver scanner is based on an older version of FOSSology in part, so they are related. Thomas did random spot checks in about 500 files from the spreadsheets for the uapi headers and agreed with SPDX license identifier in the files he inspected. For the non-uapi files Thomas did random spot checks in about 15000 files. In initial set of patches against 4.14-rc6, 3 files were found to have copy/paste license identifier errors, and have been fixed to reflect the correct identifier. Additionally Philippe spent 10 hours this week doing a detailed manual inspection and review of the 12,461 patched files from the initial patch version early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correct This produced a worksheet with 20 files needing minor correction. This worksheet was then exported into 3 different .csv files for the different types of files to be modified. These .csv files were then reviewed by Greg. Thomas wrote a script to parse the csv files and add the proper SPDX tag to the file, in the format that the file expected. This script was further refined by Greg based on the output to detect more types of files automatically and to distinguish between header and source .c files (which need different comment types.) Finally Greg ran the script using the .csv files to generate the patches. Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* ath9k: constify usb_device_idArvind Yadav2017-08-111-1/+1
| | | | | | | | | usb_device_id are not supposed to change at runtime. All functions working with usb_device_id provided by <linux/usb.h> work with const usb_device_id. So mark the non-const structs as const. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: make ath_ps_ops structures as constBhumika Goyal2017-08-082-2/+2
| | | | | | | | | ath_ps_ops structures are only stored as a reference in the ps_ops field of a ath_common structure. This field is of type const, so make the structures as const. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: Add Dell Wireless 1802 with wowlan capabilityRosen Penev2017-08-031-0/+5
| | | | | | | | | Add the Dell Wireless 1802 card as an AR9462 in the ath9k pci list. Note that the wowlan feature is supported and has been tested successfully. Signed-off by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: fix debugfs file permissionChristoph Fritz2017-08-031-1/+1
| | | | | | | | This patch fixes a trivial debugfs file permission issue. Debugfs file ack_to has no write function, so S_IWUSR gets purged. Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: remove useless variable assignment in ath_mci_intr()Gustavo A. R. Silva2017-06-281-1/+1
| | | | | | | | | Value assigned to variable offset at line 551 is overwritten at line 562, before it can be used. This makes such variable assignment useless. Addresses-Coverity-ID: 1226941 Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: Use mutex_lock to avoid potential race in start/stop rngMiaoqing Pan2017-06-281-4/+4
| | | | | | | | Move ath9k_rng_stop/ath9k_rng_start pair into critical section, use mutex_lock to void potential race accessing. Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: avoid potential freezing during random generator readMiaoqing Pan2017-06-281-1/+5
| | | | | | | | | | In the worst case, ath9k_rng_stop() may take 10s to stop rng kthread. The time is too long for users, use wait_event_interruptible_timeout() instead of msleep_interruptible(), wakup immediately once kthread_should_stop() is true. Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: fix an invalid pointer dereference in ath9k_rng_stop()Miaoqing Pan2017-06-281-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bug was triggered when do suspend/resuming continuously on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel 4.12.0-041200rc4-generic. But can't reproduce on DELL E5440 + AR9300 PCIE chips. The warning is caused by accessing invalid pointer sc->rng_task. sc->rng_task is not be cleared after kthread_stop(sc->rng_task) be called in ath9k_rng_stop(). Because the kthread is stopped before ath9k_rng_kthread() be scheduled. So set sc->rng_task to null after kthread_stop(sc->rng_task) to resolve this issue. WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100 CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031 Hardware name: Dell Inc. Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013 task: ffff950170fdda00 task.stack: ffffa22c01538000 RIP: 0010:kthread_stop+0xf1/0x100 RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246 RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000 RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680 RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680 R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018 FS: 00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0 Call Trace: ath9k_rng_stop+0x1a/0x20 [ath9k] ath9k_stop+0x3b/0x1d0 [ath9k] drv_stop+0x33/0xf0 [mac80211] ieee80211_stop_device+0x43/0x50 [mac80211] ieee80211_do_stop+0x4f2/0x810 [mac80211] Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043 Reported-by: Giulio Genovese <giulio.genovese@gmail.com> Tested-by: Giulio Genovese <giulio.genovese@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: fix tx99 bus errorMiaoqing Pan2017-06-281-2/+0
| | | | | | | | | The hard coded register 0x9864 and 0x9924 are invalid for ar9300 chips. Cc: <stable@vger.kernel.org> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath9k: fix tx99 use after freeMiaoqing Pan2017-06-281-4/+9
| | | | | | | | | | | | | | | | | One scenario that could lead to UAF is two threads writing simultaneously to the "tx99" debug file. One of them would set the "start" value to true and follow to ath9k_tx99_init(). Inside the function it would set the sc->tx99_state to true after allocating sc->tx99skb. Then, the other thread would execute write_file_tx99() and call ath9k_tx99_deinit(). sc->tx99_state would be freed. After that, the first thread would continue inside ath9k_tx99_init() and call r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl); that would make use of the freed sc->tx99_skb memory. Cc: <stable@vger.kernel.org> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
OpenPOWER on IntegriCloud