package/kernel/mac80211/patches/brcm/384-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch

   1 From a84a60ccdd65278485fb495f468a5ab91a75c649 Mon Sep 17 00:00:00 2001
   2 From: Arend van Spriel <arend.vanspriel@broadcom.com>
   3 Date: Thu, 11 Jul 2019 11:05:06 +0200
   4 Subject: [PATCH] Revert "brcmfmac: fix NULL pointer derefence during USB
   5  disconnect"
   6
   7 This reverts commit 5cdb0ef6144f47440850553579aa923c20a63f23. Subsequent
   8 changes make rework the driver code fixing the issue differently.
   9
  10 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  11 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  12 ---
  13  .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 ++---------
  14  .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h  |  6 ++----
  15  .../wireless/broadcom/brcm80211/brcmfmac/core.c  |  4 +---
  16  .../broadcom/brcm80211/brcmfmac/fwsignal.c       | 16 ++++------------
  17  .../broadcom/brcm80211/brcmfmac/fwsignal.h       |  3 +--
  18  .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++--------
  19  .../wireless/broadcom/brcm80211/brcmfmac/proto.h |  3 +--
  20  7 files changed, 13 insertions(+), 40 deletions(-)
  21
  22 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
  23 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
  24 @@ -479,18 +479,11 @@ fail:
  25         return -ENOMEM;
  26  }
  27
  28 -void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
  29 -{
  30 -       struct brcmf_bcdc *bcdc = drvr->proto->pd;
  31 -
  32 -       brcmf_fws_detach_pre_delif(bcdc->fws);
  33 -}
  34 -
  35 -void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
  36 +void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
  37  {
  38         struct brcmf_bcdc *bcdc = drvr->proto->pd;
  39
  40         drvr->proto->pd = NULL;
  41 -       brcmf_fws_detach_post_delif(bcdc->fws);
  42 +       brcmf_fws_detach(bcdc->fws);
  43         kfree(bcdc);
  44  }
  45 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
  46 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
  47 @@ -7,16 +7,14 @@
  48
  49  #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
  50  int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
  51 -void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
  52 -void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
  53 +void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
  54  void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
  55  void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
  56                                  bool success);
  57  struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
  58  #else
  59  static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
  60 -static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
  61 -static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
  62 +static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
  63  #endif
  64
  65  #endif /* BRCMFMAC_BCDC_H */
  66 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
  67 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
  68 @@ -1335,8 +1335,6 @@ void brcmf_detach(struct device *dev)
  69
  70         brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
  71
  72 -       brcmf_proto_detach_pre_delif(drvr);
  73 -
  74         if (drvr->mon_if) {
  75                 brcmf_net_detach(drvr->mon_if->ndev, false);
  76                 drvr->mon_if = NULL;
  77 @@ -1351,7 +1349,7 @@ void brcmf_detach(struct device *dev)
  78
  79         brcmf_bus_stop(drvr->bus_if);
  80
  81 -       brcmf_proto_detach_post_delif(drvr);
  82 +       brcmf_proto_detach(drvr);
  83
  84         bus_if->drvr = NULL;
  85         wiphy_free(drvr->wiphy);
  86 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
  87 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
  88 @@ -2432,25 +2432,17 @@ struct brcmf_fws_info *brcmf_fws_attach(
  89         return fws;
  90
  91  fail:
  92 -       brcmf_fws_detach_pre_delif(fws);
  93 -       brcmf_fws_detach_post_delif(fws);
  94 +       brcmf_fws_detach(fws);
  95         return ERR_PTR(rc);
  96  }
  97
  98 -void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
  99 +void brcmf_fws_detach(struct brcmf_fws_info *fws)
 100  {
 101         if (!fws)
 102                 return;
 103 -       if (fws->fws_wq) {
 104 -               destroy_workqueue(fws->fws_wq);
 105 -               fws->fws_wq = NULL;
 106 -       }
 107 -}
 108
 109 -void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
 110 -{
 111 -       if (!fws)
 112 -               return;
 113 +       if (fws->fws_wq)
 114 +               destroy_workqueue(fws->fws_wq);
 115
 116         /* cleanup */
 117         brcmf_fws_lock(fws);
 118 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
 119 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
 120 @@ -7,8 +7,7 @@
 121  #define FWSIGNAL_H_
 122
 123  struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
 124 -void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
 125 -void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
 126 +void brcmf_fws_detach(struct brcmf_fws_info *fws);
 127  void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
 128  bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
 129  bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
 130 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
 131 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
 132 @@ -56,22 +56,16 @@ fail:
 133         return -ENOMEM;
 134  }
 135
 136 -void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
 137 +void brcmf_proto_detach(struct brcmf_pub *drvr)
 138  {
 139         brcmf_dbg(TRACE, "Enter\n");
 140
 141         if (drvr->proto) {
 142                 if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
 143 -                       brcmf_proto_bcdc_detach_post_delif(drvr);
 144 +                       brcmf_proto_bcdc_detach(drvr);
 145                 else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
 146                         brcmf_proto_msgbuf_detach(drvr);
 147                 kfree(drvr->proto);
 148                 drvr->proto = NULL;
 149         }
 150  }
 151 -
 152 -void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
 153 -{
 154 -       if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
 155 -               brcmf_proto_bcdc_detach_pre_delif(drvr);
 156 -}
 157 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
 158 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
 159 @@ -43,8 +43,7 @@ struct brcmf_proto {
 160
 161
 162  int brcmf_proto_attach(struct brcmf_pub *drvr);
 163 -void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
 164 -void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
 165 +void brcmf_proto_detach(struct brcmf_pub *drvr);
 166
 167  static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
 168                                       struct sk_buff *skb,