Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

mwifiex: improve error path handling in usb.c

Browse source 
skb allocated during initialisation is reused for receiving
commands/events by USB interface. We miss to reset skb->data in
failure cases. This patch takes care of it.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kiran Divekar <dkiran@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Amitkumar Karwar 2012-06-20 20:21:13 -07:00 committed by John W. Linville
parent e80c81dc14
commit 8311f0da95
1 changed files with 17 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
drivers/net/wireless/mwifiex/usb.c
View file

@ -49,6 +49,7 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
struct device *dev = adapter->dev; struct device *dev = adapter->dev;
u32 recv_type; u32 recv_type;
__le32 tmp; __le32 tmp;
int ret;
if (adapter->hs_activated) if (adapter->hs_activated)
mwifiex_process_hs_config(adapter); mwifiex_process_hs_config(adapter);
@ -69,16 +70,19 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
case MWIFIEX_USB_TYPE_CMD: case MWIFIEX_USB_TYPE_CMD:
if (skb->len > MWIFIEX_SIZE_OF_CMD_BUFFER) { if (skb->len > MWIFIEX_SIZE_OF_CMD_BUFFER) {
dev_err(dev, "CMD: skb->len too large\n"); dev_err(dev, "CMD: skb->len too large\n");
return -1; ret = -1;
goto exit_restore_skb;
} else if (!adapter->curr_cmd) { } else if (!adapter->curr_cmd) {
dev_dbg(dev, "CMD: no curr_cmd\n"); dev_dbg(dev, "CMD: no curr_cmd\n");
if (adapter->ps_state == PS_STATE_SLEEP_CFM) { if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
mwifiex_process_sleep_confirm_resp( mwifiex_process_sleep_confirm_resp(
adapter, skb->data, adapter, skb->data,
skb->len); skb->len);
return 0; ret = 0;
goto exit_restore_skb;
} }
return -1; ret = -1;
goto exit_restore_skb;
} }
adapter->curr_cmd->resp_skb = skb; adapter->curr_cmd->resp_skb = skb;
@ -87,7 +91,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
case MWIFIEX_USB_TYPE_EVENT: case MWIFIEX_USB_TYPE_EVENT:
if (skb->len < sizeof(u32)) { if (skb->len < sizeof(u32)) {
dev_err(dev, "EVENT: skb->len too small\n"); dev_err(dev, "EVENT: skb->len too small\n");
return -1; ret = -1;
goto exit_restore_skb;
} }
skb_copy_from_linear_data(skb, &tmp, sizeof(u32)); skb_copy_from_linear_data(skb, &tmp, sizeof(u32));
adapter->event_cause = le32_to_cpu(tmp); adapter->event_cause = le32_to_cpu(tmp);
@ -95,7 +100,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
if (skb->len > MAX_EVENT_SIZE) { if (skb->len > MAX_EVENT_SIZE) {
dev_err(dev, "EVENT: event body too large\n"); dev_err(dev, "EVENT: event body too large\n");
return -1; ret = -1;
goto exit_restore_skb;
} }
memcpy(adapter->event_body, skb->data + memcpy(adapter->event_body, skb->data +
@ -124,6 +130,12 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
} }
return -EINPROGRESS; return -EINPROGRESS;
exit_restore_skb:
/* The buffer will be reused for further cmds/events */
skb_push(skb, INTF_HEADER_LEN);
return ret;
} }
static void mwifiex_usb_rx_complete(struct urb *urb) static void mwifiex_usb_rx_complete(struct urb *urb)