package/kernel/mac80211/patches/brcm/104-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch

   1 From 7acf04a0ae2adf5d3e9de9adeec3129e74bf6ef2 Mon Sep 17 00:00:00 2001
   2 From: Arend van Spriel <arend.vanspriel@broadcom.com>
   3 Date: Thu, 11 Jul 2019 11:05:06 +0200
   4 Subject: [PATCH 1/7] Revert "brcmfmac: fix NULL pointer derefence during USB
   5  disconnect"
   6
   7 This reverts commit 5cdb0ef6144f47440850553579aa923c20a63f23. Subsequent
   8 changes make rework the driver code fixing the issue differently.
   9
  10 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  11 ---
  12  .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 ++---------
  13  .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h  |  6 ++----
  14  .../wireless/broadcom/brcm80211/brcmfmac/core.c  |  4 +---
  15  .../broadcom/brcm80211/brcmfmac/fwsignal.c       | 16 ++++------------
  16  .../broadcom/brcm80211/brcmfmac/fwsignal.h       |  3 +--
  17  .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++--------
  18  .../wireless/broadcom/brcm80211/brcmfmac/proto.h |  3 +--
  19  7 files changed, 13 insertions(+), 40 deletions(-)
  20
  21 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
  22 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
  23 @@ -479,18 +479,11 @@ fail:
  24         return -ENOMEM;
  25  }
  26
  27 -void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
  28 -{
  29 -       struct brcmf_bcdc *bcdc = drvr->proto->pd;
  30 -
  31 -       brcmf_fws_detach_pre_delif(bcdc->fws);
  32 -}
  33 -
  34 -void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
  35 +void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
  36  {
  37         struct brcmf_bcdc *bcdc = drvr->proto->pd;
  38
  39         drvr->proto->pd = NULL;
  40 -       brcmf_fws_detach_post_delif(bcdc->fws);
  41 +       brcmf_fws_detach(bcdc->fws);
  42         kfree(bcdc);
  43  }
  44 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
  45 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
  46 @@ -7,16 +7,14 @@
  47
  48  #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
  49  int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
  50 -void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
  51 -void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
  52 +void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
  53  void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
  54  void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
  55                                  bool success);
  56  struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
  57  #else
  58  static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
  59 -static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
  60 -static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
  61 +static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
  62  #endif
  63
  64  #endif /* BRCMFMAC_BCDC_H */
  65 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
  66 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
  67 @@ -1335,8 +1335,6 @@ void brcmf_detach(struct device *dev)
  68
  69         brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
  70
  71 -       brcmf_proto_detach_pre_delif(drvr);
  72 -
  73         /* make sure primary interface removed last */
  74         for (i = BRCMF_MAX_IFS-1; i > -1; i--)
  75                 brcmf_remove_interface(drvr->iflist[i], false);
  76 @@ -1346,7 +1344,7 @@ void brcmf_detach(struct device *dev)
  77
  78         brcmf_bus_stop(drvr->bus_if);
  79
  80 -       brcmf_proto_detach_post_delif(drvr);
  81 +       brcmf_proto_detach(drvr);
  82
  83         bus_if->drvr = NULL;
  84         wiphy_free(drvr->wiphy);
  85 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
  86 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
  87 @@ -2432,25 +2432,17 @@ struct brcmf_fws_info *brcmf_fws_attach(
  88         return fws;
  89
  90  fail:
  91 -       brcmf_fws_detach_pre_delif(fws);
  92 -       brcmf_fws_detach_post_delif(fws);
  93 +       brcmf_fws_detach(fws);
  94         return ERR_PTR(rc);
  95  }
  96
  97 -void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
  98 +void brcmf_fws_detach(struct brcmf_fws_info *fws)
  99  {
 100         if (!fws)
 101                 return;
 102 -       if (fws->fws_wq) {
 103 -               destroy_workqueue(fws->fws_wq);
 104 -               fws->fws_wq = NULL;
 105 -       }
 106 -}
 107
 108 -void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
 109 -{
 110 -       if (!fws)
 111 -               return;
 112 +       if (fws->fws_wq)
 113 +               destroy_workqueue(fws->fws_wq);
 114
 115         /* cleanup */
 116         brcmf_fws_lock(fws);
 117 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
 118 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
 119 @@ -7,8 +7,7 @@
 120  #define FWSIGNAL_H_
 121
 122  struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
 123 -void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
 124 -void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
 125 +void brcmf_fws_detach(struct brcmf_fws_info *fws);
 126  void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
 127  bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
 128  bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
 129 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
 130 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
 131 @@ -56,22 +56,16 @@ fail:
 132         return -ENOMEM;
 133  }
 134
 135 -void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
 136 +void brcmf_proto_detach(struct brcmf_pub *drvr)
 137  {
 138         brcmf_dbg(TRACE, "Enter\n");
 139
 140         if (drvr->proto) {
 141                 if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
 142 -                       brcmf_proto_bcdc_detach_post_delif(drvr);
 143 +                       brcmf_proto_bcdc_detach(drvr);
 144                 else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
 145                         brcmf_proto_msgbuf_detach(drvr);
 146                 kfree(drvr->proto);
 147                 drvr->proto = NULL;
 148         }
 149  }
 150 -
 151 -void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
 152 -{
 153 -       if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
 154 -               brcmf_proto_bcdc_detach_pre_delif(drvr);
 155 -}
 156 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
 157 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
 158 @@ -43,8 +43,7 @@ struct brcmf_proto {
 159
 160
 161  int brcmf_proto_attach(struct brcmf_pub *drvr);
 162 -void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
 163 -void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
 164 +void brcmf_proto_detach(struct brcmf_pub *drvr);
 165
 166  static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
 167                                       struct sk_buff *skb,