[ 3.5.y.z extended stable ] Patch "mwifiex: fix incomplete scan in case of IE parsing error" has been added to staging queue

[Herton Ronaldo Krzesinski]

This is a note to let you know that I have just added a patch titled

    mwifiex: fix incomplete scan in case of IE parsing error

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Herton

------

>From b5c685611706a1bf28d25af1a32519eaf401e883 Mon Sep 17 00:00:00 2001
From: Bing Zhao <bzhao at marvell.com>
Date: Tue, 29 Jan 2013 14:38:02 -0800
Subject: [PATCH] mwifiex: fix incomplete scan in case of IE parsing error

commit 8a7d7cbf7b5ff9912ef50b3e94c9ad9f37b1c75f upstream.

A scan request is split into multiple scan commands queued in
scan_pending_q. Each scan command will be sent to firmware and
its response is handlded one after another.

If any error is detected while parsing IE in command response
buffer the remaining data will be ignored and error is returned.

We should check if there is any more scan commands pending in
the queue before returning error. This ensures that we will call
cfg80211_scan_done if this is the last scan command, or send
next scan command in scan_pending_q to firmware.

Signed-off-by: Bing Zhao <bzhao at marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar at marvell.com>
Signed-off-by: John W. Linville <linville at tuxdriver.com>
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski at canonical.com>
---
 drivers/net/wireless/mwifiex/scan.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 74f0457..9ca1b9c 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1553,7 +1553,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 		dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
 			scan_rsp->number_of_sets);
 		ret = -1;
-		goto done;
+		goto check_next_scan;
 	}

 	bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1624,7 +1624,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 		if (!beacon_size || beacon_size > bytes_left) {
 			bss_info += bytes_left;
 			bytes_left = 0;
-			return -1;
+			ret = -1;
+			goto check_next_scan;
 		}

 		/* Initialize the current working beacon pointer for this BSS
@@ -1680,7 +1681,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 				dev_err(priv->adapter->dev,
 					"%s: bytes left < IE length\n",
 					__func__);
-				goto done;
+				goto check_next_scan;
 			}
 			if (element_id == WLAN_EID_DS_PARAMS) {
 				channel = *(u8 *) (current_ptr +
@@ -1744,6 +1745,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 		}
 	}

+check_next_scan:
 	spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
 	if (list_empty(&adapter->scan_pending_q)) {
 		spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -1782,7 +1784,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 		mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
 	}

-done:
 	return ret;
 }

--
1.7.9.5