Commit Graph

589736 Commits

Author SHA1 Message Date
Strashko, Grygorii
16669befb0 PM / wakeirq: fix wakeirq setting after wakup re-configuration from sysfs
Now wakeirq stops working for device if wakeup option for
this device will be reconfigured through sysfs, like:

echo disabled > /sys/devices/platform/extcon_usb1/power/wakeup
echo enabled > /sys/devices/platform/extcon_usb1/power/wakeup

Once above set of commands is executed the device's wakeup_source
opject will be recreated and dev->power.wakeup->wakeirq field will
contain NULL. As result, device_wakeup_arm_wake_irqs() will not arm
wakeirq for the affected device.

Hece, lets try to fix it in the following way:
  check for dev->wakeirq field when device_wakeup_attach() is called
  and if !NULL re-attach wakeirq to the device

Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:23:47 +02:00
Len Brown
9185e988e9 tools/power turbostat: work around RC6 counter wrap
Sometimes the rc6 sysfs counter spontaneously resets,
causing turbostat prints a very large number
as it tries to calcuate % = 100 * (old - new) / interval

When we see (old > new), print ***.**% instead
of a bogus huge number.

Note that this detection is not fool-proof, as the counter
could reset several times and still result in new > old.

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:18:40 +02:00
Len Brown
cdc57272ea tools/power turbostat: initial KBL support
KBL is similar to SKL

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:18:38 +02:00
Len Brown
ec53e594c6 tools/power turbostat: initial SKX support
SKX has a lot in common with HSX

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:18:36 +02:00
Len Brown
e8efbc80db tools/power turbostat: decode BXT TSC frequency via CPUID
Hard-code BXT ART to 19200MHz, so turbostat --debug
can fully enumerate TSC:

CPUID(0x15): eax_crystal: 3 ebx_tsc: 186 ecx_crystal_hz: 0
TSC: 1190 MHz (19200000 Hz * 186 / 3 / 1000000)

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:18:35 +02:00
Len Brown
e4085d543e tools/power turbostat: initial BXT support
Broxton has a lot in common with SKL

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:18:33 +02:00
Len Brown
5a63426e2a tools/power turbostat: print IRTL MSRs
Some processors use the Interrupt Response Time Limit (IRTL) MSR value
to describe the maximum IRQ response time latency for deep
package C-states.  (Though others have the register, but do not use it)
Lets print it out to give insight into the cases where it is used.

IRTL begain in SNB, with PC3/PC6/PC7, and HSW added PC8/PC9/PC10.

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:18:32 +02:00
Len Brown
8ae7225591 tools/power turbostat: SGX state should print only if --debug
The CPUID.SGX bit was printed, even if --debug was used

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:18:30 +02:00
Len Brown
3ce093d4de intel_idle: Add KBL support
KBL is similar to SKL

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:11:08 +02:00
Len Brown
f9e71657c2 intel_idle: Add SKX support
SKX is similar to BDX

Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:11:06 +02:00
Richard Cochran
3e66a9ab53 intel_idle: Clean up all registered devices on exit.
This driver registers cpuidle devices when a CPU comes online, but it
leaves the registrations in place when a CPU goes offline.  The module
exit code only unregisters the currently online CPUs, leaving the
devices for offline CPUs dangling.

This patch changes the driver to clean up all registrations on exit,
even those from CPUs that are offline.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:11:05 +02:00
Richard Cochran
08820546e4 intel_idle: Propagate hot plug errors.
If a cpuidle registration error occurs during the hot plug notifier
callback, we should really inform the hot plug machinery instead of
just ignoring the error.  This patch changes the callback to properly
return on error.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:11:02 +02:00
Richard Cochran
b69ef2c099 intel_idle: Don't overreact to a cpuidle registration failure.
The helper function, intel_idle_cpu_init, registers one new device
with the cpuidle layer.  If the registration should fail, that
function immediately calls intel_idle_cpuidle_devices_uninit() to
unregister every last CPU's device.  However, it makes no sense to do
so, when called from the hot plug notifier callback.

This patch moves the call to intel_idle_cpuidle_devices_uninit()
outside of the helper function to the one call site that actually
needs to perform the de-registrations.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:11:00 +02:00
Richard Cochran
2259a819a8 intel_idle: Setup the timer broadcast only on successful driver load.
This driver sets the broadcast tick quite early on during probe and does
not clean up again in cast of failure.  This patch moves the setup call
after the registration, placing the on_each_cpu() calls within the global
CPU lock region.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:10:58 +02:00
Richard Cochran
ca42489d9e intel_idle: Avoid a double free of the per-CPU data.
The helper function, intel_idle_cpuidle_devices_uninit, frees the
globally allocated per-CPU data.  However, this function is invoked
from the hot plug notifier callback at a time when freeing that data
is not safe.

If the call to cpuidle_register_driver() should fail (say, due to lack
of memory), then the driver will free its per-CPU region.  On the
*next* CPU_ONLINE event, the driver will happily use the region again
and even free it again if the failure repeats.

This patch fixes the issue by moving the call to free_percpu() outside
of the helper function at the two call sites that actually need to
free the per-CPU data.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:10:57 +02:00
Richard Cochran
e9df69ccd1 intel_idle: Fix dangling registration on error path.
In the module_init() method, if the per-CPU allocation fails, then the
active cpuidle registration is not cleaned up.  This patch fixes the
issue by attempting the allocation before registration, and then
cleaning it up again on registration failure.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:10:56 +02:00
Richard Cochran
51319918bc intel_idle: Fix deallocation order on the driver exit path.
In the module_exit() method, this driver first frees its per-CPU
pointer, then unregisters a callback making use of the pointer.
Furthermore, the function, intel_idle_cpuidle_devices_uninit, is racy
against CPU hot plugging as it calls for_each_online_cpu().

This patch corrects the issues by unregistering first on the exit path
while holding the hot plug lock.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:10:54 +02:00
Richard Cochran
4a3dfb3fc0 intel_idle: Remove redundant initialization calls.
The function, intel_idle_cpuidle_driver_init, makes calls on each CPU
to auto_demotion_disable() and c1e_promotion_disable().  These calls
are redundant, as intel_idle_cpu_init() does the same calls just a bit
later on.  They are also premature, as the driver registration may yet
fail.

This patch removes the redundant code.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:10:53 +02:00
Richard Cochran
5469c827d2 intel_idle: Fix a helper function's return value.
The function, intel_idle_cpuidle_driver_init, delivers no error codes
at all.  This patch changes the function to return 'void' instead of
returning zero.

Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:10:51 +02:00
Richard Cochran
f70415496d intel_idle: remove useless return from void function.
Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2016-04-07 22:10:50 +02:00
Kalle Valo
20ac1b325d Merge ath-next from ath.git
ath.git patches for 4.7. Major changes:

ath10k

* implement push-pull tx model using mac80211 software queuing support
* enable scan in AP mode (NL80211_FEATURE_AP_SCAN)

wil6210

* add basic PBSS (Personal Basic Service Set) support
* add initial P2P support
* add oob_mode module parameter
2016-04-07 21:44:37 +03:00
Haishuang Yan
85f1e7c29a netfilter: ipv6: unnecessary to check whether ip6_route_output() returns NULL
ip6_route_output() never returns NULL, so it is not appropriate to
check if the return value is NULL.

Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2016-04-07 18:53:08 +02:00
Xinming Hu
4646968b94 mwifiex: dump pcie scratch registers
This patch prints pcie scratch registers during firmware dump. They
will be useful for analysing firmware status.

Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:42:26 +03:00
Xinming Hu
bf00dc22bc mwifiex: AMSDU Rx frame handling in AP mode
This patch processes sub AMSDU frame received in AP mode.

If a packet is multicast/broadcast, it is sent to kernel/upper
layer as well as queued back to AP TX queue so that it can be
sent to other associated stations.

If a packet is unicast and RA is present in associated station list,
it is again requeued into AP TX queue.

If a packet is unicast and RA is not in associated station list,
packet is forwarded to kernel to handle routing logic.

Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:42:25 +03:00
Xinming Hu
ad5ca845e3 mwifiex: schedule main workqueue for transmitting bridge packets
Bridge packets are enqueued to wmm tx queue, but will not be sent
until main workqeue is scheduled for new interrupt or other
reason. This adds unnecessary delay during traffic.

We will schedule main workqueue when bridge packet is queued.

Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:42:22 +03:00
Xinming Hu
00c5478049 mwifiex: remove redundant GFP_DMA flag
skb forwarded to TCP/IP stack doesn't need to allocate in DMA ZONE.
This patch removes GFP_DMA flag in this case to save precious DMA
memory.

Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:42:21 +03:00
Shengzhen Li
a362e16b83 mwifiex: check revision id while choosing PCIe firmware
Some of the chipsets have two revisions. This patch
selects appropriate firmware by checking revision id.

Signed-off-by: Shengzhen Li <szli@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:42:19 +03:00
Ganapathi Bhat
8fa0a0dc63 mwifiex: add support for wakeup on GTK rekey failure
User can configure wakeup on GTK rekey fail with wowlan.
Added corresponding wakeup reason.

Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:42:18 +03:00
Ganapathi Bhat
f6b1cbe029 mwifiex: add support for GTK rekey offload
Added driver functionality to offload GTK rekey to firmware. When
AP sends new GTK, firmware will update it.

Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:42:17 +03:00
Jes Sorensen
a069caa3c3 rtl8xxxu: Do not set LDOA15 / LDOV12 on 8192eu
Per the vendor driver, it looks like the 8192eu doesn't have LDOA15 /
LDOV12 registers.

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:21 +03:00
Jes Sorensen
91cbe4e731 rtl8xxxu: Use correct H2C calls for 8192eu
The 8192eu uses the same H2C API as the 8723bu. Call the correct
functions for update_rate_mask() and report_connect().

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:20 +03:00
Jes Sorensen
af13faff85 rtl8xxxu: Identify 8192eu rev A/B parts correctly
8192eu A/B cut parts were incorrectly identified as 8192cu devices.

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:19 +03:00
Jes Sorensen
ba17d82478 rtl8xxxu: Use enums for chip version numbers
With support for more chips being added, use an enum to specify the
chip version.

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:18 +03:00
Jes Sorensen
931d927825 rtl8xxxu: Update some register definitions
Improve descriptive names of some registers and add some additional
registers only found on nextgen chips.

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:17 +03:00
Jes Sorensen
f3fc251162 rtl8xxxu: 8192eu uses txdesc40
8192eu uses the new TX descriptor format

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:16 +03:00
Jes Sorensen
1df1de3485 rtl8xxxu: TXDESC_SHORT_GI is txdesc32 only
This is no short GI bit in the txdesc40 format.

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:15 +03:00
Jes Sorensen
169bc5cb0b rtl8xxxu: Correct txdesc40 gid definition
txdesc40 dword2 gid is a 6 bit field, not a single bit

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:14 +03:00
Jes Sorensen
33f3724948 rtl8xxxu: Rename TX descriptor bits to map them to 32/40 byte descriptors
With the size based naming of TX descriptors. Change the bit
definition namings to indicate which descriptor format they match,
rather than having a device name in the bit name.

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:13 +03:00
Jes Sorensen
dbb2896b48 rtl8xxxu: Change name of struct tx_desc to be more decriptive
There are two major types of TX descriptor formats for the RTL parts,
the old 32 byte descriptor, and the newer 40 byte descriptor used by
the 8723bu, 8192eu, and 88xx series.

Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:41:12 +03:00
Wei-Ning Huang
a5c92f0b6a mwifiex: fix NULL pointer dereference error
In mwifiex_enable_hs, we need to check if
priv->wdev.wiphy->wowlan_config is NULL before accessing its member.
This sometimes cause kernel panic when suspend/resume.

Signed-off-by: Wei-Ning Huang <wnhuang@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:40:29 +03:00
Colin Ian King
001351881d mwifiex: ie_list is an array, so no need to check if NULL
ap_ie->ie_list is an array of struct mwifiex_ie and can never
be null, so the null check on this array is redundant and can
be removed.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:39:18 +03:00
Julian Calaby
84d17a2a5a iwl4965: Fix more memory leaks in __il4965_up()
In some of the non-success return paths, the memory allocated by
iwl4965_sta_alloc_lq() in iwl4965_alloc_bcast_station() is not freed.

In particular:
 - if the card isn't ready after il4965_prepare_card_hw()
 - if the card is hardware-rfkilled

In the hardware rfkilled path, the driver enables the rfkill
interrupt. When the card is unrfkilled and this interrupt is raised
we end up calling il4965_bg_restart() which calls __il4965_up() which
calls iwl4965_alloc_bcast_station() again.

Suggested-by: Jia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:50 +03:00
Jia-Ju Bai
c2fd34469d iwl4965: Fix a memory leak in error handling code of __il4965_up
When il4965_hw_nic_init in __il4965_up fails, the memory allocated by
iwl4965_sta_alloc_lq in iwl4965_alloc_bcast_station is not freed.

This patches adds il_dealloc_bcast_stations in the error handling code of
__il4965_up to fix this problem.

This patch has been tested in real device, and it actually fixes the bug.

Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:49 +03:00
Markus Elfring
37190b2694 rsi: Move variable initialisation into error code
In rsi_send_data_pkt(), it's a little more logical to assign 'status' in
the actual error handling code as opposed to at the top of the functon.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
[Deleted controversial bits, rewrote commit message]
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:48 +03:00
Markus Elfring
ab2ef1d68f rsi: Delete unnecessary variable initialisation
In rsi_send_data_pkt(), the following variables are assigned to
before they're used:

 * tmp_hdr - Assigned on line 47, first used on line 48
 * bss - Assigned on line 41, first used on line 44
 * extnd_size - Assigned on line 50, first used on line 52
 * seq_num - Assigned on line 48, first used on line 96

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
[Rewrote commit message]
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:47 +03:00
Markus Elfring
8b28310efe rsi: Delete unnecessary variable initialisation
In rsi_send_mgmt_pkt(), the following variables are assigned to
before they're used:

 * wh - Assigned on line 161, first used on line 180
 * bss - Assigned on line 160, first used on line 196
 * msg - Assigned on line 168, first used on line 175
 * extnd_size - Assigned on line 139, first used on line 142

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
[Rewrote commit message]
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:46 +03:00
Jia-Ju Bai
1c76b4902c rtl818x_pci: Disable pci device in error handling code
When pci_request_regions in rtl8180_probe fails, pci_disable_device is not
called to disable the device which is enabled by pci_enbale_device.

This patch fixes the problem by adding a new lable in error handling code.

Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Acked-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:45 +03:00
Jia-Ju Bai
96838d6110 b43: Fix memory leaks in b43_bus_dev_ssb_init and b43_bus_dev_bcma_init
The memory allocated by kzalloc in b43_bus_dev_ssb_init and
b43_bus_dev_bcma_init is not freed.
This patch fixes the bug by adding kfree in b43_ssb_remove,
b43_bcma_remove and error handling code of b43_bcma_probe.

Thanks Michael for his suggestion.

Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:44 +03:00
Jia-Ju Bai
fe9b47944e iwl4965: Fix a null pointer dereference in il_tx_queue_free and il_cmd_queue_free
If "txq->cmd = kzalloc(...)" in il_tx_queue_init fails,
"kfree(txq->cmd[i])" in il_tx_queue_free and il_cmd_queue_free
in iwl4965_hw_txq_ctx_free will causes a null pointer dereference,
because txq->cmd is NULL at that time.

This patch fixes this problem by adding a if-check before kfree.
To avoid double free in il_tx_queue_free and il_cmd_queue_free
caused by the fixing, txq->meta and txq->cmd in error handling code
of il_tx_queue_init are assigned null values.
Otherwise, a double free will occur.

This patch has been tested in real device, and it actually fixes the bug.
Thanks Stanislaw for his suggestion.

Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:43 +03:00
Markus Elfring
fb9693f045 iwlegacy: Return directly if allocation fails in il_eeprom_init()
Also remove an unused label.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
[Rewrote commit message]
Signed-off-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2016-04-07 19:37:42 +03:00