summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDmitry Shmidt <dimitrysh@google.com>2009-11-15 11:03:09 -0800
committerDmitry Shmidt <dimitrysh@google.com>2009-11-15 11:06:04 -0800
commitd29f5394f1031539fad5a35facc3ede57c33d574 (patch)
tree035b3ad3f1b375e4287e7317e30524713ba221a5
parent9080924374f5b58dd135eb21594ef1672d34be88 (diff)
downloadandroid_hardware_broadcom_wlan-d29f5394f1031539fad5a35facc3ede57c33d574.tar.gz
android_hardware_broadcom_wlan-d29f5394f1031539fad5a35facc3ede57c33d574.tar.bz2
android_hardware_broadcom_wlan-d29f5394f1031539fad5a35facc3ede57c33d574.zip
bcm4329: Kill watchdog before "driver stop" command, (b/2249878)
Fix scan with more than 200 APs memory corruption Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
-rw-r--r--bcm4329/src/dhd/sys/dhd_linux.c8
-rw-r--r--bcm4329/src/wl/sys/wl_iw.c20
2 files changed, 19 insertions, 9 deletions
diff --git a/bcm4329/src/dhd/sys/dhd_linux.c b/bcm4329/src/dhd/sys/dhd_linux.c
index 2927532..135db37 100644
--- a/bcm4329/src/dhd/sys/dhd_linux.c
+++ b/bcm4329/src/dhd/sys/dhd_linux.c
@@ -2523,8 +2523,16 @@ dhd_dev_reset(struct net_device *dev, uint8 flag)
{
dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+ /* Turning off watchdog */
+ if (flag)
+ dhd_os_wd_timer(&dhd->pub, 0);
+
dhd_bus_devreset(&dhd->pub, flag);
+ /* Turning on watchdog back */
+ if (!flag)
+ dhd_os_wd_timer(&dhd->pub, dhd_watchdog_ms);
+
DHD_ERROR(("%s: WLAN OFF DONE\n", __FUNCTION__));
return 1;
diff --git a/bcm4329/src/wl/sys/wl_iw.c b/bcm4329/src/wl/sys/wl_iw.c
index f92e186..ef70a96 100644
--- a/bcm4329/src/wl/sys/wl_iw.c
+++ b/bcm4329/src/wl/sys/wl_iw.c
@@ -2370,16 +2370,18 @@ wl_iw_get_scan_prep(
if (bi->rateset.count) {
- value = event + IW_EV_LCP_LEN;
- iwe.cmd = SIOCGIWRATE;
-
- iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
- for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
- iwe.u.bitrate.value = (bi->rateset.rates[j] & 0x7f) * 500000;
- value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
- IW_EV_PARAM_LEN);
+ if (((event - extra) + IW_EV_LCP_LEN) <= (int)end) {
+ value = event + IW_EV_LCP_LEN;
+ iwe.cmd = SIOCGIWRATE;
+
+ iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+ for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
+ iwe.u.bitrate.value = (bi->rateset.rates[j] & 0x7f) * 500000;
+ value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
+ IW_EV_PARAM_LEN);
+ }
+ event = value;
}
- event = value;
}
}