Commit e3de5bb7 authored by Pradeep Kumar Chitrapu's avatar Pradeep Kumar Chitrapu Committed by Kalle Valo
Browse files

ath11k: fix thermal temperature read 



Fix dangling pointer in thermal temperature event which causes
incorrect temperature read.

Tested-on: IPQ8074 AHB WLAN.HK.2.4.0.1-00041-QCAHKSWPL_SILICONZ-1

Signed-off-by: default avatarPradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210218182708.8844-1-pradeepc@codeaurora.org
parent 3808a180

drivers/net/wireless/ath/ath11k/wmi.c

+21 −32
Original line number Diff line number Diff line
@@ -5417,31 +5417,6 @@ int ath11k_wmi_pull_fw_stats(struct ath11k_base *ab, struct sk_buff *skb, 
	return 0;

}



static int

ath11k_pull_pdev_temp_ev(struct ath11k_base *ab, u8 *evt_buf,

			 u32 len, const struct wmi_pdev_temperature_event *ev)

{

	const void **tb;

	int ret;



	tb = ath11k_wmi_tlv_parse_alloc(ab, evt_buf, len, GFP_ATOMIC);

	if (IS_ERR(tb)) {

		ret = PTR_ERR(tb);

		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);

		return ret;

	}



	ev = tb[WMI_TAG_PDEV_TEMPERATURE_EVENT];

	if (!ev) {

		ath11k_warn(ab, "failed to fetch pdev temp ev");

		kfree(tb);

		return -EPROTO;

	}



	kfree(tb);

	return 0;

}



size_t ath11k_wmi_fw_stats_num_vdevs(struct list_head *head)

{

	struct ath11k_fw_stats_vdev *i;
@@ -6849,23 +6824,37 @@ ath11k_wmi_pdev_temperature_event(struct ath11k_base *ab, 
				  struct sk_buff *skb)

{

	struct ath11k *ar;

	struct wmi_pdev_temperature_event ev = {0};

	const void **tb;

	const struct wmi_pdev_temperature_event *ev;

	int ret;



	tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC);

	if (IS_ERR(tb)) {

		ret = PTR_ERR(tb);

		ath11k_warn(ab, "failed to parse tlv: %d\n", ret);

		return;

	}



	if (ath11k_pull_pdev_temp_ev(ab, skb->data, skb->len, &ev) != 0) {

		ath11k_warn(ab, "failed to extract pdev temperature event");

	ev = tb[WMI_TAG_PDEV_TEMPERATURE_EVENT];

	if (!ev) {

		ath11k_warn(ab, "failed to fetch pdev temp ev");

		kfree(tb);

		return;

	}



	ath11k_dbg(ab, ATH11K_DBG_WMI,

		   "pdev temperature ev temp %d pdev_id %d\n", ev.temp, ev.pdev_id);

		   "pdev temperature ev temp %d pdev_id %d\n", ev->temp, ev->pdev_id);



	ar = ath11k_mac_get_ar_by_pdev_id(ab, ev.pdev_id);

	ar = ath11k_mac_get_ar_by_pdev_id(ab, ev->pdev_id);

	if (!ar) {

		ath11k_warn(ab, "invalid pdev id in pdev temperature ev %d", ev.pdev_id);

		ath11k_warn(ab, "invalid pdev id in pdev temperature ev %d", ev->pdev_id);

		kfree(tb);

		return;

	}



	ath11k_thermal_event_temperature(ar, ev.temp);

	ath11k_thermal_event_temperature(ar, ev->temp);



	kfree(tb);

}



static void ath11k_fils_discovery_event(struct ath11k_base *ab,