mwifiex: check driver status in connect and scan handlers

Ignore scan and connection requests from cfg80211 when driver
unload is in process or previous command has timed out due to
a firmware bug. This patch fixes corner case system crash
issues.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index b3bf2cd..7be1e9b 100644 (file)
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1786,6 +1786,7 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                         struct cfg80211_connect_params *sme)
 {
        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+       struct mwifiex_adapter *adapter = priv->adapter;
        int ret;
 
        if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) {
@@ -1800,6 +1801,13 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                return -EALREADY;
        }
 
+       if (adapter->surprise_removed || adapter->is_cmd_timedout) {
+               wiphy_err(wiphy,
+                         "%s: Ignore connection. Card removed or FW in bad state\n",
+                         dev->name);
+               return -EFAULT;
+       }
+
        wiphy_dbg(wiphy, "info: Trying to associate to %s and bssid %pM\n",
                  (char *) sme->ssid, sme->bssid);
 

diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 984a7a4..e304f07 100644 (file)
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1429,6 +1429,12 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                return -EBUSY;
        }
 
+       if (adapter->surprise_removed || adapter->is_cmd_timedout) {
+               dev_err(adapter->dev,
+                       "Ignore scan. Card removed or firmware in bad state\n");
+               return -EFAULT;
+       }
+
        spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
        adapter->scan_processing = true;
        spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);