Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

[linux-2.6-microblaze.git] / drivers / net / wireless / broadcom / brcm80211 / brcmfmac / cfg80211.c

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index aaed4ab..4bfd43a 100644 (file)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -980,7 +980,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 
        eth_broadcast_addr(params_le->bssid);
        params_le->bss_type = DOT11_BSSTYPE_ANY;
-       params_le->scan_type = 0;
+       params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
        params_le->channel_num = 0;
        params_le->nprobes = cpu_to_le32(-1);
        params_le->active_time = cpu_to_le32(-1);
@@ -988,12 +988,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
        params_le->home_time = cpu_to_le32(-1);
        memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 
-       /* if request is null exit so it will be all channel broadcast scan */
-       if (!request)
-               return;
-
        n_ssids = request->n_ssids;
        n_channels = request->n_channels;
+
        /* Copy channel array if applicable */
        brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
                  n_channels);
@@ -1030,16 +1027,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
                        ptr += sizeof(ssid_le);
                }
        } else {
-               brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
-               if ((request->ssids) && request->ssids->ssid_len) {
-                       brcmf_dbg(SCAN, "SSID %s len=%d\n",
-                                 params_le->ssid_le.SSID,
-                                 request->ssids->ssid_len);
-                       params_le->ssid_le.SSID_len =
-                               cpu_to_le32(request->ssids->ssid_len);
-                       memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
-                               request->ssids->ssid_len);
-               }
+               brcmf_dbg(SCAN, "Performing passive scan\n");
+               params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
        }
        /* Adding mask to channel numbers */
        params_le->channel_num =
@@ -3162,6 +3151,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
        struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
        s32 status;
        struct brcmf_escan_result_le *escan_result_le;
+       u32 escan_buflen;
        struct brcmf_bss_info_le *bss_info_le;
        struct brcmf_bss_info_le *bss = NULL;
        u32 bi_length;
@@ -3181,11 +3171,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
 
        if (status == BRCMF_E_STATUS_PARTIAL) {
                brcmf_dbg(SCAN, "ESCAN Partial result\n");
+               if (e->datalen < sizeof(*escan_result_le)) {
+                       brcmf_err("invalid event data length\n");
+                       goto exit;
+               }
                escan_result_le = (struct brcmf_escan_result_le *) data;
                if (!escan_result_le) {
                        brcmf_err("Invalid escan result (NULL pointer)\n");
                        goto exit;
                }
+               escan_buflen = le32_to_cpu(escan_result_le->buflen);
+               if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+                   escan_buflen > e->datalen ||
+                   escan_buflen < sizeof(*escan_result_le)) {
+                       brcmf_err("Invalid escan buffer length: %d\n",
+                                 escan_buflen);
+                       goto exit;
+               }
                if (le16_to_cpu(escan_result_le->bss_count) != 1) {
                        brcmf_err("Invalid bss_count %d: ignoring\n",
                                  escan_result_le->bss_count);
@@ -3202,9 +3204,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                }
 
                bi_length = le32_to_cpu(bss_info_le->length);
-               if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
-                                       WL_ESCAN_RESULTS_FIXED_SIZE)) {
-                       brcmf_err("Invalid bss_info length %d: ignoring\n",
+               if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
+                       brcmf_err("Ignoring invalid bss_info length: %d\n",
                                  bi_length);
                        goto exit;
                }
@@ -3260,9 +3261,8 @@ static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
                            brcmf_cfg80211_escan_handler);
        cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
        /* Init scan_timeout timer */
-       init_timer(&cfg->escan_timeout);
-       cfg->escan_timeout.data = (unsigned long) cfg;
-       cfg->escan_timeout.function = brcmf_escan_timeout;
+       setup_timer(&cfg->escan_timeout, brcmf_escan_timeout,
+                   (unsigned long)cfg);
        INIT_WORK(&cfg->escan_timeout_work,
                  brcmf_cfg80211_escan_timeout_worker);
 }