Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

brcmfmac: only use ifidx from BDC header in brcmf_rx_frames()

In brcmf_rx_frames() the call to brcmf_fweh_process_skb() could
change the ifidx using information in the event data. This is
only different to the BDC ifidx for IF ADD event. However, the
creation of the new interface is deferred to event worker so
it does not exist. After brcmf_fweh_process_skb() it is only
used to set statistics.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

authored by

Arend van Spriel and committed by
John W. Linville
deb09280 5b57af6e

+7 -14
+2 -7
drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
··· 323 323 /* Strip header, count, deliver upward */ 324 324 skb_pull(skb, ETH_HLEN); 325 325 326 - /* Process special event packets and then discard them */ 327 - brcmf_fweh_process_skb(drvr, skb, &ifidx); 328 - 329 - if (drvr->iflist[ifidx]) { 330 - ifp = drvr->iflist[ifidx]; 331 - ifp->ndev->last_rx = jiffies; 332 - } 326 + /* Process special event packets */ 327 + brcmf_fweh_process_skb(drvr, skb); 333 328 334 329 if (!(ifp->ndev->flags & IFF_UP)) { 335 330 brcmu_pkt_buf_free_skb(skb);
+2 -4
drivers/net/wireless/brcm80211/brcmfmac/fweh.c
··· 407 407 * 408 408 * @drvr: driver information object. 409 409 * @event_packet: event packet to process. 410 - * @ifidx: index of the firmware interface (may change). 411 410 * 412 411 * If the packet buffer contains a firmware event message it will 413 412 * dispatch the event to a registered handler (using worker). 414 413 */ 415 414 void brcmf_fweh_process_event(struct brcmf_pub *drvr, 416 - struct brcmf_event *event_packet, u8 *ifidx) 415 + struct brcmf_event *event_packet) 417 416 { 418 417 enum brcmf_fweh_event_code code; 419 418 struct brcmf_fweh_info *fweh = &drvr->fweh; ··· 424 425 /* get event info */ 425 426 code = get_unaligned_be32(&event_packet->msg.event_type); 426 427 datalen = get_unaligned_be32(&event_packet->msg.datalen); 427 - *ifidx = event_packet->msg.ifidx; 428 428 data = &event_packet[1]; 429 429 430 430 if (code >= BRCMF_E_LAST) ··· 440 442 return; 441 443 442 444 event->code = code; 443 - event->ifidx = *ifidx; 445 + event->ifidx = event_packet->msg.ifidx; 444 446 445 447 /* use memcpy to get aligned event message */ 446 448 memcpy(&event->emsg, &event_packet->msg, sizeof(event->emsg));
+3 -3
drivers/net/wireless/brcm80211/brcmfmac/fweh.h
··· 187 187 enum brcmf_fweh_event_code code); 188 188 int brcmf_fweh_activate_events(struct brcmf_if *ifp); 189 189 void brcmf_fweh_process_event(struct brcmf_pub *drvr, 190 - struct brcmf_event *event_packet, u8 *ifidx); 190 + struct brcmf_event *event_packet); 191 191 192 192 static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr, 193 - struct sk_buff *skb, u8 *ifidx) 193 + struct sk_buff *skb) 194 194 { 195 195 struct brcmf_event *event_packet; 196 196 u8 *data; ··· 213 213 if (usr_stype != BCMILCP_BCM_SUBTYPE_EVENT) 214 214 return; 215 215 216 - brcmf_fweh_process_event(drvr, event_packet, ifidx); 216 + brcmf_fweh_process_event(drvr, event_packet); 217 217 } 218 218 219 219 #endif /* FWEH_H_ */