@@ -497,8 +497,11 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
/* Get BSS number and corresponding priv */
priv = mwifiex_get_priv_by_id(adapter, EVENT_GET_BSS_NUM(eventcause));
- if (!priv)
- priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+ if (!priv) {
+ mwifiex_dbg(adapter, ERROR, "received event on unused bss_num %d\n",
+ EVENT_GET_BSS_NUM(eventcause));
+ return -EINVAL;
+ }
/* Clear BSS_NO_BITS from event */
eventcause &= EVENT_ID_MASK;
@@ -861,8 +864,12 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
/* Get BSS number and corresponding priv */
priv = mwifiex_get_priv_by_id(adapter,
HostCmd_GET_BSS_NO(le16_to_cpu(resp->seq_num)));
- if (!priv)
- priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+ if (!priv) {
+ mwifiex_dbg(adapter, ERROR, "received event on unused bss_num %d\n",
+ HostCmd_GET_BSS_NO(le16_to_cpu(resp->seq_num)));
+ return -EINVAL;
+ }
+
/* Clear RET_BIT from HostCmd */
resp->command = cpu_to_le16(orig_cmdresp_no & HostCmd_CMD_ID_MASK);
@@ -32,12 +32,10 @@ int mwifiex_handle_rx_packet(struct mwifiex_adapter *adapter,
local_rx_pd = (struct rxpd *) (skb->data);
/* Get the BSS number from rxpd, get corresponding priv */
priv = mwifiex_get_priv_by_id(adapter, local_rx_pd->bss_num & BSS_NUM_MASK);
- if (!priv)
- priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
-
if (!priv) {
mwifiex_dbg(adapter, ERROR,
- "data: priv not found. Drop RX packet\n");
+ "data: recived RX packet on unused bss_num %d. Dropping it\n",
+ local_rx_pd->bss_num & BSS_NUM_MASK);
dev_kfree_skb_any(skb);
return -1;
}
When we receive an event, command response or RX packet on with a bss_num we haven't sent then it must be a driver or firmware bug. It makes no sense to continue with an arbitrary bss in this case, so print an error message and bail out with an error. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> --- drivers/net/wireless/marvell/mwifiex/cmdevt.c | 15 +++++++++++---- drivers/net/wireless/marvell/mwifiex/txrx.c | 6 ++---- 2 files changed, 13 insertions(+), 8 deletions(-)