linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 5.11 001/104] ath11k: fix thermal temperature read
@ 2021-05-05 16:32 Sasha Levin
  2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 046/104] mac80211: Set priority and queue mapping for injected frames Sasha Levin
                   ` (17 more replies)
  0 siblings, 18 replies; 19+ messages in thread
From: Sasha Levin @ 2021-05-05 16:32 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Pradeep Kumar Chitrapu, Kalle Valo, Sasha Levin, ath11k,
	linux-wireless, netdev

From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>

[ Upstream commit e3de5bb7ac1a4cb262f8768924fd3ef6182b10bb ]

Fix dangling pointer in thermal temperature event which causes
incorrect temperature read.

Tested-on: IPQ8074 AHB WLAN.HK.2.4.0.1-00041-QCAHKSWPL_SILICONZ-1

Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210218182708.8844-1-pradeepc@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 53 +++++++++++----------------
 1 file changed, 21 insertions(+), 32 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 73869d445c5b..f457a089b63c 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5190,31 +5190,6 @@ int ath11k_wmi_pull_fw_stats(struct ath11k_base *ab, struct sk_buff *skb,
 	return 0;
 }
 
-static int
-ath11k_pull_pdev_temp_ev(struct ath11k_base *ab, u8 *evt_buf,
-			 u32 len, const struct wmi_pdev_temperature_event *ev)
-{
-	const void **tb;
-	int ret;
-
-	tb = ath11k_wmi_tlv_parse_alloc(ab, evt_buf, len, GFP_ATOMIC);
-	if (IS_ERR(tb)) {
-		ret = PTR_ERR(tb);
-		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
-		return ret;
-	}
-
-	ev = tb[WMI_TAG_PDEV_TEMPERATURE_EVENT];
-	if (!ev) {
-		ath11k_warn(ab, "failed to fetch pdev temp ev");
-		kfree(tb);
-		return -EPROTO;
-	}
-
-	kfree(tb);
-	return 0;
-}
-
 size_t ath11k_wmi_fw_stats_num_vdevs(struct list_head *head)
 {
 	struct ath11k_fw_stats_vdev *i;
@@ -6622,23 +6597,37 @@ ath11k_wmi_pdev_temperature_event(struct ath11k_base *ab,
 				  struct sk_buff *skb)
 {
 	struct ath11k *ar;
-	struct wmi_pdev_temperature_event ev = {0};
+	const void **tb;
+	const struct wmi_pdev_temperature_event *ev;
+	int ret;
+
+	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);
+	if (IS_ERR(tb)) {
+		ret = PTR_ERR(tb);
+		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);
+		return;
+	}
 
-	if (ath11k_pull_pdev_temp_ev(ab, skb->data, skb->len, &ev) != 0) {
-		ath11k_warn(ab, "failed to extract pdev temperature event");
+	ev = tb[WMI_TAG_PDEV_TEMPERATURE_EVENT];
+	if (!ev) {
+		ath11k_warn(ab, "failed to fetch pdev temp ev");
+		kfree(tb);
 		return;
 	}
 
 	ath11k_dbg(ab, ATH11K_DBG_WMI,
-		   "pdev temperature ev temp %d pdev_id %d\n", ev.temp, ev.pdev_id);
+		   "pdev temperature ev temp %d pdev_id %d\n", ev->temp, ev->pdev_id);
 
-	ar = ath11k_mac_get_ar_by_pdev_id(ab, ev.pdev_id);
+	ar = ath11k_mac_get_ar_by_pdev_id(ab, ev->pdev_id);
 	if (!ar) {
-		ath11k_warn(ab, "invalid pdev id in pdev temperature ev %d", ev.pdev_id);
+		ath11k_warn(ab, "invalid pdev id in pdev temperature ev %d", ev->pdev_id);
+		kfree(tb);
 		return;
 	}
 
-	ath11k_thermal_event_temperature(ar, ev.temp);
+	ath11k_thermal_event_temperature(ar, ev->temp);
+
+	kfree(tb);
 }
 
 static void ath11k_fils_discovery_event(struct ath11k_base *ab,
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 19+ messages in thread
end of thread, other threads:[~2021-05-05 16:47 UTC | newest]

Thread overview: 19+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-05 16:32 [PATCH AUTOSEL 5.11 001/104] ath11k: fix thermal temperature read Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 046/104] mac80211: Set priority and queue mapping for injected frames Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 047/104] mac80211: clear the beacon's CRC after channel switch Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 050/104] rtw88: 8822c: add LC calibration for RTL8822C Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 051/104] mt76: mt7615: fix key set/delete issues Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 052/104] mt76: mt7615: support loading EEPROM for MT7613BE Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 053/104] mt76: mt76x0: disable GTK offloading Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 054/104] mt76: mt7915: always check return value from mt7915_mcu_alloc_wtbl_req Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 055/104] mt76: mt7915: fix key set/delete issue Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 056/104] mt76: mt7915: fix txpower init for TSSI off chips Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 057/104] mt76: mt7915: add wifi subsystem reset Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 062/104] iwlwifi: pcie: make cfg vs. trans_cfg more robust Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 063/104] iwlwifi: queue: avoid memory leak in reset flow Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 078/104] wilc1000: Bring MAC address setting in line with typical Linux behavior Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 079/104] mac80211: properly drop the connection in case of invalid CSA IE Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 088/104] mt76: mt7615: fix entering driver-own state on mt7663 Sasha Levin
2021-05-05 16:33 ` [PATCH AUTOSEL 5.11 090/104] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt Sasha Levin
2021-05-05 16:34 ` [PATCH AUTOSEL 5.11 091/104] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join Sasha Levin
2021-05-05 16:34 ` [PATCH AUTOSEL 5.11 092/104] qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).