* [PATCH 1/2] mt76: dma: reset q->rx_head on rx reset
@ 2019-08-22 7:33 Felix Fietkau
2019-08-22 7:33 ` [PATCH 2/2] mt76: stop rx aggregation on station removal Felix Fietkau
0 siblings, 1 reply; 2+ messages in thread
From: Felix Fietkau @ 2019-08-22 7:33 UTC (permalink / raw)
To: linux-wireless
Fixes rx of the first frame if a fragmented rx was interrupted by the reset
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/mediatek/mt76/dma.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 46f5223b4d89..c747eb24581c 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -431,6 +431,12 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
mt76_dma_rx_cleanup(dev, q);
mt76_dma_sync_idx(dev, q);
mt76_dma_rx_fill(dev, q);
+
+ if (!q->rx_head)
+ return;
+
+ dev_kfree_skb(q->rx_head);
+ q->rx_head = NULL;
}
static void
--
2.17.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH 2/2] mt76: stop rx aggregation on station removal
2019-08-22 7:33 [PATCH 1/2] mt76: dma: reset q->rx_head on rx reset Felix Fietkau
@ 2019-08-22 7:33 ` Felix Fietkau
0 siblings, 0 replies; 2+ messages in thread
From: Felix Fietkau @ 2019-08-22 7:33 UTC (permalink / raw)
To: linux-wireless
Fixes use-after-free issues on forced station removal during hardware restart
on MT76x02
Fixes: aee5b8cf2477 ("mt76: implement A-MPDU rx reordering in the driver code")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/mediatek/mt76/mac80211.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index aeb535204c4d..32ddbf088817 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -708,6 +708,9 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif,
rcu_assign_pointer(dev->wcid[idx], NULL);
synchronize_rcu();
+ for (i = 0; i < ARRAY_SIZE(wcid->aggr); i++)
+ mt76_rx_aggr_stop(dev, wcid, i);
+
if (dev->drv->sta_remove)
dev->drv->sta_remove(dev, vif, sta);
--
2.17.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-08-22 7:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-22 7:33 [PATCH 1/2] mt76: dma: reset q->rx_head on rx reset Felix Fietkau
2019-08-22 7:33 ` [PATCH 2/2] mt76: stop rx aggregation on station removal Felix Fietkau
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).