Search Linux Wireless

w35und: fixed nasty stack overflow, I can actually ssh over this

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Removed nasty stack overflow, and got transmit of big packets to
work. I can now actually do ssh over softmac-based driver.

Unindent code to make it more readable.

---
commit 0cfb0fd5cde408c154de69fa1c5521d5288ca506
tree 2814afd5b2b385bd3885c2095e94f03ca7dd8e20
parent 5b251c6315097d5f9ab5d30c43813fe74c1db4e4
author Pavel <pavel@xxxxxxxxxx> Mon, 05 May 2008 22:40:29 +0200
committer Pavel <pavel@xxxxxxxxxx> Mon, 05 May 2008 22:40:29 +0200

 arch/x86/kernel/traps_32.c                         |    5 +
 .../wireless/winbond/winbondport/linux/wb35tx.c    |   19 +-
 .../net/wireless/winbond/winbondport/linux/wbusb.c |    8 +
 drivers/net/wireless/winbond/winbondport/mds.c     |  192 ++++++++++----------
 .../net/wireless/winbond/winbondport/mlmetxrx.c    |   12 +
 5 files changed, 118 insertions(+), 118 deletions(-)

diff --git a/arch/x86/kernel/traps_32.c b/arch/x86/kernel/traps_32.c
index b22c01e..c3e9949 100644
--- a/arch/x86/kernel/traps_32.c
+++ b/arch/x86/kernel/traps_32.c
@@ -146,11 +146,16 @@ static inline unsigned long print_contex
 				unsigned long *stack, unsigned long bp,
 				const struct stacktrace_ops *ops, void *data)
 {
+	int max = 5;
 	struct stack_frame *frame = (struct stack_frame *)bp;
 
 	while (valid_stack_ptr(tinfo, stack, sizeof(*stack))) {
 		unsigned long addr;
 
+		if (!max)
+			return;
+		max--;
+
 		addr = *stack;
 		if (__kernel_text_address(addr)) {
 			if ((unsigned long) stack == bp + 4) {
diff --git a/drivers/net/wireless/winbond/winbondport/linux/wb35tx.c b/drivers/net/wireless/winbond/winbondport/linux/wb35tx.c
index 9211206..6ce7905 100644
--- a/drivers/net/wireless/winbond/winbondport/linux/wb35tx.c
+++ b/drivers/net/wireless/winbond/winbondport/linux/wb35tx.c
@@ -67,15 +67,13 @@ void Wb35Tx(phw_data_t pHwData)
 	pWb35Tx->EP4vm_state = VM_RUNNING;
 	retv = wb_usb_submit_urb( pUrb );
 	if (retv<0) {
-#ifdef _PE_TX_DUMP_
-		WBDEBUG(("EP4 Tx Irp sending error\n"));
-#endif
+		printk("EP4 Tx Irp sending error\n");
 		goto cleanup;
 	}
 
 	// Check if driver needs issue Irp for EP2
 	pWb35Tx->TxFillCount += pMds->TxCountInBuffer[SendIndex];
-	if( pWb35Tx->TxFillCount > 12 ) // Fixed to 12. 20060928
+	if (pWb35Tx->TxFillCount > 12)
 		Wb35Tx_EP2VM_start( pHwData );
 
 	pWb35Tx->ByteTransfer += pMds->TxBufferSize[SendIndex];
@@ -96,13 +94,12 @@ void Wb35Tx_complete(struct urb * pUrb)
 
 	// Variable setting
 	pWb35Tx->EP4vm_state = VM_COMPLETED;
-	pWb35Tx->EP4VM_status = pUrb->status;//Store the last result of Irp
+	pWb35Tx->EP4VM_status = pUrb->status; //Store the last result of Irp
 	pMds->TxOwner[ pWb35Tx->TxSendIndex ] = 0;// Set the owner. Free the owner bit always.
 	pWb35Tx->TxSendIndex++;
 	pWb35Tx->TxSendIndex %= MAX_USB_TX_BUFFER_NUMBER;
 	
-	do
-	{
+	do {
 		if (pHwData->SurpriseRemove || pHwData->HwStop) // Let WbWlanHalt to handle surprise remove
 			break;
 
@@ -111,15 +108,11 @@ void Wb35Tx_complete(struct urb * pUrb)
 
 		// The URB is completed, check the result
 		if (pWb35Tx->EP4VM_status != 0) {
-			#ifdef _PE_USB_STATE_DUMP_
-			WBDEBUG(("EP4 IoCompleteRoutine return error\n"));
-			DebugUsbdStatusInformation( pWb35Tx->EP4VM_status );
-			#endif
+			printk("URB submission failed\n");
 			pWb35Tx->EP4vm_state = VM_STOP;
 			break; // Exit while(FALSE);
 		}
 
-		// Do the next send
 		Mds_Tx(Adapter);
 		Wb35Tx(pHwData);
 		return;
@@ -131,7 +124,7 @@ void Wb35Tx_complete(struct urb * pUrb)
 
 void Wb35Tx_reset_descriptor(  phw_data_t pHwData )
 {
-	PWB35TX		pWb35Tx = &pHwData->Wb35Tx;
+	PWB35TX pWb35Tx = &pHwData->Wb35Tx;
 
 	pWb35Tx->TxSendIndex = 0;
 	pWb35Tx->tx_halt = 0;
diff --git a/drivers/net/wireless/winbond/winbondport/linux/wbusb.c b/drivers/net/wireless/winbond/winbondport/linux/wbusb.c
index 8c9451a..6d08071 100644
--- a/drivers/net/wireless/winbond/winbondport/linux/wbusb.c
+++ b/drivers/net/wireless/winbond/winbondport/linux/wbusb.c
@@ -113,7 +113,9 @@ static void wbsoft_configure_filter(stru
 static int wbsoft_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
 		      struct ieee80211_tx_control *control)
 {
-	if (1 == MLMESendFrame(my_adapter, skb->data, skb->len, FRAME_TYPE_802_11_MANAGEMENT))
+	char *buffer = kmalloc(skb->len, GFP_ATOMIC);
+	memcpy(buffer, skb->data, skb->len);
+	if (1 == MLMESendFrame(my_adapter, buffer, skb->len, FRAME_TYPE_802_11_MANAGEMENT))
 		printk("frame sent ok?\n");
 	return NETDEV_TX_OK;
 }
@@ -330,8 +332,10 @@ void packet_came(char *pRxBufferAddress,
 		return;
 
 	skb = dev_alloc_skb(PacketSize);
-	if (!skb)
+	if (!skb) {
 		printk("Not enough memory for packet, FIXME\n");
+		return;
+	}
 
 	memcpy(skb_put(skb, PacketSize),
 	       pRxBufferAddress,
diff --git a/drivers/net/wireless/winbond/winbondport/mds.c b/drivers/net/wireless/winbond/winbondport/mds.c
index 44f3b61..91b60f1 100644
--- a/drivers/net/wireless/winbond/winbondport/mds.c
+++ b/drivers/net/wireless/winbond/winbondport/mds.c
@@ -52,126 +52,126 @@ Mds_Tx(PADAPTER Adapter)
 		return;
 
 	//Only one thread can be run here
-	if (OS_ATOMIC_INC( Adapter, &pMds->TxThreadCount) == 1)	{
-		// Start to fill the data
+	if (!OS_ATOMIC_INC( Adapter, &pMds->TxThreadCount) == 1)
+		goto cleanup;
+
+	// Start to fill the data
+	do {
+		FillIndex = pMds->TxFillIndex;
+		if (pMds->TxOwner[FillIndex]) { // Is owned by software 0:Yes 1:No
+#ifdef _PE_TX_DUMP_
+			WBDEBUG(("[Mds_Tx] Tx Owner is H/W.\n"));
+#endif
+			break;
+		}
+
+		XmitBufAddress = pMds->pTxBuffer + (MAX_USB_TX_BUFFER * FillIndex); //Get buffer
+		XmitBufSize = 0;
+		FillCount = 0;
 		do {
-			FillIndex = pMds->TxFillIndex;
-			if (pMds->TxOwner[FillIndex]) { // Is owned by software 0:Yes 1:No
-				#ifdef _PE_TX_DUMP_
-				WBDEBUG(("[Mds_Tx] Tx Owner is H/W.\n"));
-				#endif
+			PacketSize = Adapter->sMlmeFrame.len;
+			if (!PacketSize)
 				break;
+
+			//For Check the buffer resource
+			FragmentThreshold = CURRENT_FRAGMENT_THRESHOLD;
+			//931130.5.b
+			FragmentCount = PacketSize/FragmentThreshold + 1;
+			stmp = PacketSize + FragmentCount*32 + 8;//931130.5.c 8:MIC
+			if ((XmitBufSize + stmp) >= MAX_USB_TX_BUFFER) {
+				printk("[Mds_Tx] Excess max tx buffer.\n");
+				break; // buffer is not enough
 			}
 
-			XmitBufAddress = pMds->pTxBuffer + (MAX_USB_TX_BUFFER * FillIndex); //Get buffer
-			XmitBufSize = 0;
-			FillCount = 0;
-			do {
-				PacketSize = Adapter->sMlmeFrame.len;
-				if (!PacketSize)
-					break;
-
-				//For Check the buffer resource
-				FragmentThreshold = CURRENT_FRAGMENT_THRESHOLD;
-				//931130.5.b
-				FragmentCount = PacketSize/FragmentThreshold + 1;
-				stmp = PacketSize + FragmentCount*32 + 8;//931130.5.c 8:MIC
-				if ((XmitBufSize + stmp) >= MAX_USB_TX_BUFFER) {
-					#ifdef _PE_TX_DUMP_
-					WBDEBUG(("[Mds_Tx] Excess max tx buffer.\n"));
-					#endif
-					break; // buffer is not enough
-				}
-
-
-				//
-				// Start transmitting
-				//
-				BufferFilled = TRUE;
-
-				/* Leaves first u8 intact */
-				memset((PUCHAR)pTxDes + 1, 0, sizeof(DESCRIPTOR) - 1);
+
+			//
+			// Start transmitting
+			//
+			BufferFilled = TRUE;
+
+			/* Leaves first u8 intact */
+			memset((PUCHAR)pTxDes + 1, 0, sizeof(DESCRIPTOR) - 1);
 				
-				TxDesIndex = pMds->TxDesIndex;//Get the current ID
-				pTxDes->Descriptor_ID = TxDesIndex;
-				pMds->TxDesFrom[ TxDesIndex ] = 2;//Storing the information of source comming from
-				pMds->TxDesIndex++;
-				pMds->TxDesIndex %= MAX_USB_TX_DESCRIPTOR;
+			TxDesIndex = pMds->TxDesIndex;//Get the current ID
+			pTxDes->Descriptor_ID = TxDesIndex;
+			pMds->TxDesFrom[ TxDesIndex ] = 2;//Storing the information of source comming from
+			pMds->TxDesIndex++;
+			pMds->TxDesIndex %= MAX_USB_TX_DESCRIPTOR;
 				
-				MLME_GetNextPacket( Adapter, pTxDes );
+			MLME_GetNextPacket( Adapter, pTxDes );
 
-				// Copy header. 8byte USB + 24byte 802.11Hdr. Set TxRate, Preamble type
-				Mds_HeaderCopy( Adapter, pTxDes, XmitBufAddress );
+			// Copy header. 8byte USB + 24byte 802.11Hdr. Set TxRate, Preamble type
+			Mds_HeaderCopy( Adapter, pTxDes, XmitBufAddress );
 
-				// For speed up Key setting
-				if (pTxDes->EapFix) {
-					#ifdef _PE_TX_DUMP_
-					WBDEBUG(("35: EPA 4th frame detected. Size = %d\n", PacketSize));
-					#endif
-					pHwData->IsKeyPreSet = 1;
-				}
+			// For speed up Key setting
+			if (pTxDes->EapFix) {
+#ifdef _PE_TX_DUMP_
+				WBDEBUG(("35: EPA 4th frame detected. Size = %d\n", PacketSize));
+#endif
+				pHwData->IsKeyPreSet = 1;
+			}
 
-				// Copy (fragment) frame body, and set USB, 802.11 hdr flag
-				CurrentSize = Mds_BodyCopy(Adapter, pTxDes, XmitBufAddress);
+			// Copy (fragment) frame body, and set USB, 802.11 hdr flag
+			CurrentSize = Mds_BodyCopy(Adapter, pTxDes, XmitBufAddress);
 
-				// Set RTS/CTS and Normal duration field into buffer
-				Mds_DurationSet(Adapter, pTxDes, XmitBufAddress);
+			// Set RTS/CTS and Normal duration field into buffer
+			Mds_DurationSet(Adapter, pTxDes, XmitBufAddress);
 
-				//
-				// Calculation MIC from buffer which maybe fragment, then fill into temporary address 8 byte
-				// 931130.5.e
-				if (MICAdd)
-					Mds_MicFill( Adapter, pTxDes, XmitBufAddress );
+			//
+			// Calculation MIC from buffer which maybe fragment, then fill into temporary address 8 byte
+			// 931130.5.e
+			if (MICAdd)
+				Mds_MicFill( Adapter, pTxDes, XmitBufAddress );
 
-				//Shift to the next address
-				XmitBufSize += CurrentSize;
-				XmitBufAddress += CurrentSize;
+			//Shift to the next address
+			XmitBufSize += CurrentSize;
+			XmitBufAddress += CurrentSize;
 
-				#ifdef _IBSS_BEACON_SEQ_STICK_
-				if ((XmitBufAddress[ DOT_11_DA_OFFSET+8 ] & 0xfc) != MAC_SUBTYPE_MNGMNT_PROBE_REQUEST) // +8 for USB hdr
-				#endif
-					pMds->TxToggle = TRUE;
+#ifdef _IBSS_BEACON_SEQ_STICK_
+			if ((XmitBufAddress[ DOT_11_DA_OFFSET+8 ] & 0xfc) != MAC_SUBTYPE_MNGMNT_PROBE_REQUEST) // +8 for USB hdr
+#endif
+				pMds->TxToggle = TRUE;
 
-				// Get packet to transmit completed, 1:TESTSTA 2:MLME 3: Ndis data
-				MLME_SendComplete(Adapter, 0, TRUE);
+			// Get packet to transmit completed, 1:TESTSTA 2:MLME 3: Ndis data
+			MLME_SendComplete(Adapter, 0, TRUE);
 
-				// Software TSC count 20060214
-				pMds->TxTsc++;
-				if (pMds->TxTsc == 0)
-					pMds->TxTsc_2++;
+			// Software TSC count 20060214
+			pMds->TxTsc++;
+			if (pMds->TxTsc == 0)
+				pMds->TxTsc_2++;
 
-				FillCount++; // 20060928
-			} while (HAL_USB_MODE_BURST(pHwData)); // End of multiple MSDU copy loop. FALSE = single TRUE = multiple sending
+			FillCount++; // 20060928
+		} while (HAL_USB_MODE_BURST(pHwData)); // End of multiple MSDU copy loop. FALSE = single TRUE = multiple sending
 
-			// Move to the next one, if necessary
-			if (BufferFilled) {
-				// size setting
-				pMds->TxBufferSize[ FillIndex ] = XmitBufSize;
+		// Move to the next one, if necessary
+		if (BufferFilled) {
+			// size setting
+			pMds->TxBufferSize[ FillIndex ] = XmitBufSize;
 
-				// 20060928 set Tx count
-				pMds->TxCountInBuffer[FillIndex] = FillCount;
+			// 20060928 set Tx count
+			pMds->TxCountInBuffer[FillIndex] = FillCount;
 
-				// Set owner flag
-				pMds->TxOwner[FillIndex] = 1;
+			// Set owner flag
+			pMds->TxOwner[FillIndex] = 1;
 
-				pMds->TxFillIndex++;
-				pMds->TxFillIndex %= MAX_USB_TX_BUFFER_NUMBER;
-				BufferFilled = FALSE;
-			} else
-				break;
+			pMds->TxFillIndex++;
+			pMds->TxFillIndex %= MAX_USB_TX_BUFFER_NUMBER;
+			BufferFilled = FALSE;
+		} else
+			break;
 
-			if (!PacketSize) // No more pk for transmitting
-				break;
+		if (!PacketSize) // No more pk for transmitting
+			break;
 
-		} while(TRUE);
+	} while(TRUE);
 
-		//
-		// Start to send by lower module
-		//
-		if (!pHwData->IsKeyPreSet)
-			Wb35Tx_start(pHwData);
-	}
+	//
+	// Start to send by lower module
+	//
+	if (!pHwData->IsKeyPreSet)
+		Wb35Tx_start(pHwData);
 
+ cleanup:
 	OS_ATOMIC_DEC( Adapter, &pMds->TxThreadCount );
 }
 
diff --git a/drivers/net/wireless/winbond/winbondport/mlmetxrx.c b/drivers/net/wireless/winbond/winbondport/mlmetxrx.c
index 04bcbaa..bff42c7 100644
--- a/drivers/net/wireless/winbond/winbondport/mlmetxrx.c
+++ b/drivers/net/wireless/winbond/winbondport/mlmetxrx.c
@@ -75,8 +75,8 @@ u8 MLMESendFrame(PWB32_ADAPTER Adapter, 
 /*	DataType : FRAME_TYPE_802_11_MANAGEMENT, FRAME_TYPE_802_11_MANAGEMENT_CHALLENGE,
 				FRAME_TYPE_802_11_DATA */
 {
-	if( Adapter->sMlmeFrame.IsInUsed != PACKET_FREE_TO_USE ) {
-		Adapter->sMlmeFrame.wNumTxMMPDUDiscarded ++;
+	if (Adapter->sMlmeFrame.IsInUsed != PACKET_FREE_TO_USE) {
+		Adapter->sMlmeFrame.wNumTxMMPDUDiscarded++;
 		return FALSE;
 	}
 	Adapter->sMlmeFrame.IsInUsed = PACKET_COME_FROM_MLME;
@@ -84,17 +84,15 @@ u8 MLMESendFrame(PWB32_ADAPTER Adapter, 
 	// Keep information for sending
 	Adapter->sMlmeFrame.pMMPDU = pMMPDU;
 	Adapter->sMlmeFrame.DataType = DataType;
-	Adapter->sMlmeFrame.len = len; // It must be the last setting due to QUERY_SIZE_SECOND of Mds
+	// len must be the last setting due to QUERY_SIZE_SECOND of Mds
+	Adapter->sMlmeFrame.len = len;
 	Adapter->sMlmeFrame.wNumTxMMPDU++;
 
 	// H/W will enter power save by set the register. S/W don't send null frame
 	//with PWRMgt bit enbled to enter power save now.
 
 	// Transmit NDIS packet
-	Mds_Tx( Adapter );
-#ifdef _PE_TX_DUMP_
-	WBDEBUG(("MLMESendFrame->mds_tx_ok\n"));
-#endif
+	Mds_Tx(Adapter);
 	return TRUE;
 }
 



!-------------------------------------------------------------flip-


Removed nasty stack overflow, and got transmit of big packets to
work. I can now actually do ssh over softmac-based driver.

---
commit 78b9049df56fbd5fc785b4e7e9c93dbfb8390d2a
tree 2290532e477ee36bd33a7e6e91c6f3207420c9e2
parent 0cfb0fd5cde408c154de69fa1c5521d5288ca506
author Pavel <pavel@xxxxxxxxxx> Mon, 05 May 2008 22:54:25 +0200
committer Pavel <pavel@xxxxxxxxxx> Mon, 05 May 2008 22:54:25 +0200

 .../wireless/winbond/winbondport/linux/wb35tx.c    |    1 +
 .../net/wireless/winbond/winbondport/linux/wbusb.c |    3 ++-
 drivers/net/wireless/winbond/winbondport/mlme_s.h  |    2 +-
 .../net/wireless/winbond/winbondport/mlmetxrx.c    |   11 +----------
 4 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/drivers/net/wireless/winbond/winbondport/linux/wb35tx.c b/drivers/net/wireless/winbond/winbondport/linux/wb35tx.c
index 6ce7905..be877fd 100644
--- a/drivers/net/wireless/winbond/winbondport/linux/wb35tx.c
+++ b/drivers/net/wireless/winbond/winbondport/linux/wb35tx.c
@@ -92,6 +92,7 @@ void Wb35Tx_complete(struct urb * pUrb)
 	PWB35TX		pWb35Tx = &pHwData->Wb35Tx;
 	PMDS		pMds = &Adapter->Mds;
 
+	printk("wb35: tx complete\n");
 	// Variable setting
 	pWb35Tx->EP4vm_state = VM_COMPLETED;
 	pWb35Tx->EP4VM_status = pUrb->status; //Store the last result of Irp
diff --git a/drivers/net/wireless/winbond/winbondport/linux/wbusb.c b/drivers/net/wireless/winbond/winbondport/linux/wbusb.c
index 6d08071..cc48892 100644
--- a/drivers/net/wireless/winbond/winbondport/linux/wbusb.c
+++ b/drivers/net/wireless/winbond/winbondport/linux/wbusb.c
@@ -114,9 +114,10 @@ static int wbsoft_tx(struct ieee80211_hw
 		      struct ieee80211_tx_control *control)
 {
 	char *buffer = kmalloc(skb->len, GFP_ATOMIC);
+	printk("Sending frame %d bytes\n", skb->len);
 	memcpy(buffer, skb->data, skb->len);
 	if (1 == MLMESendFrame(my_adapter, buffer, skb->len, FRAME_TYPE_802_11_MANAGEMENT))
-		printk("frame sent ok?\n");
+		printk("frame sent ok (%d bytes)?\n", skb->len);
 	return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/wireless/winbond/winbondport/mlme_s.h b/drivers/net/wireless/winbond/winbondport/mlme_s.h
index ade89e4..29ca71b 100644
--- a/drivers/net/wireless/winbond/winbondport/mlme_s.h
+++ b/drivers/net/wireless/winbond/winbondport/mlme_s.h
@@ -112,7 +112,7 @@ #define MLMEMSG_TIMEOUT					0x50
 ///////////////////////////////////////////////////////////////////////////
 //Global data structures
 #define MAX_NUM_TX_MMPDU	2
-#define MAX_MMPDU_SIZE		512
+#define MAX_MMPDU_SIZE		1512
 #define MAX_NUM_RX_MMPDU	6
 
 
diff --git a/drivers/net/wireless/winbond/winbondport/mlmetxrx.c b/drivers/net/wireless/winbond/winbondport/mlmetxrx.c
index bff42c7..ce70d3f 100644
--- a/drivers/net/wireless/winbond/winbondport/mlmetxrx.c
+++ b/drivers/net/wireless/winbond/winbondport/mlmetxrx.c
@@ -134,22 +134,13 @@ void
 MLME_SendComplete(PADAPTER Adapter, u8 PacketID, unsigned char SendOK)
 {
 	MLME_TXCALLBACK	TxCallback;
-	u8		DataTmp[200];
-
-	memcpy(DataTmp, Adapter->sMlmeFrame.pMMPDU, Adapter->sMlmeFrame.len);
 
     // Reclaim the data buffer
 	Adapter->sMlmeFrame.len = 0;
 	MLMEfreeMMPDUBuffer( Adapter, Adapter->sMlmeFrame.pMMPDU );
 
 
-	//TODO : ?? The pData has been returned, but we still use it to know what kind
-	//			of mlme frame it is. Will it be dangerous??
-	TxCallback.psFramePtr = DataTmp;
-	if (SendOK)
-		TxCallback.bResult = MLME_SUCCESS;
-	else
-		TxCallback.bResult = TRANSMIT_FRAME_FAIL;
+	TxCallback.bResult = MLME_SUCCESS;
 
 	// Return resource
 	Adapter->sMlmeFrame.IsInUsed = PACKET_FREE_TO_USE;



!-------------------------------------------------------------flip-




-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux