Unverified Commit 4682ccae authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7045 v2 b43: fix CVE-2023-52644 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/3JG5NZBEX5SXUND4ZQYYZWL2V3TILJTO/ 
fix CVE-2023-52644

Rahul Rameshbabu (1):
  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled

Saurav Girepunje (1):
  b43: dma: Fix use true/false for bool type variable


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I9HK94 
 
Link:https://gitee.com/openeuler/kernel/pulls/7045

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents b90aae59 e930fd0c

drivers/net/wireless/broadcom/b43/b43.h

+16 −0
Original line number Diff line number Diff line
@@ -1082,6 +1082,22 @@ static inline bool b43_using_pio_transfers(struct b43_wldev *dev) 
	return dev->__using_pio_transfers;

}



static inline void b43_wake_queue(struct b43_wldev *dev, int queue_prio)

{

	if (dev->qos_enabled)

		ieee80211_wake_queue(dev->wl->hw, queue_prio);

	else

		ieee80211_wake_queue(dev->wl->hw, 0);

}



static inline void b43_stop_queue(struct b43_wldev *dev, int queue_prio)

{

	if (dev->qos_enabled)

		ieee80211_stop_queue(dev->wl->hw, queue_prio);

	else

		ieee80211_stop_queue(dev->wl->hw, 0);

}



/* Message printing */

__printf(2, 3) void b43info(struct b43_wl *wl, const char *fmt, ...);

__printf(2, 3) void b43err(struct b43_wl *wl, const char *fmt, ...);

drivers/net/wireless/broadcom/b43/dma.c

+4 −4
Original line number Diff line number Diff line
@@ -1461,8 +1461,8 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb) 
	    should_inject_overflow(ring)) {

		/* This TX ring is full. */

		unsigned int skb_mapping = skb_get_queue_mapping(skb);

		ieee80211_stop_queue(dev->wl->hw, skb_mapping);

		dev->wl->tx_queue_stopped[skb_mapping] = 1;

		b43_stop_queue(dev, skb_mapping);

		dev->wl->tx_queue_stopped[skb_mapping] = true;

		ring->stopped = true;

		if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {

			b43dbg(dev->wl, "Stopped TX ring %d\n", ring->index);
@@ -1628,11 +1628,11 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev, 
	}



	if (dev->wl->tx_queue_stopped[ring->queue_prio]) {

		dev->wl->tx_queue_stopped[ring->queue_prio] = 0;

		dev->wl->tx_queue_stopped[ring->queue_prio] = false;

	} else {

		/* If the driver queue is running wake the corresponding

		 * mac80211 queue. */

		ieee80211_wake_queue(dev->wl->hw, ring->queue_prio);

		b43_wake_queue(dev, ring->queue_prio);

		if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {

			b43dbg(dev->wl, "Woke up TX ring %d\n", ring->index);

		}