bcm4329: Fix watchdog timer race conditions (b/2249878)

         Fix "garbage" scan results processing

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

2 files changed, 9 insertions, 28 deletions

diff --git a/bcm4329/src/dhd/sys/dhd_linux.c b/bcm4329/src/dhd/sys/dhd_linux.c
index 54fb62f..88c5d6a 100644
--- a/bcm4329/src/dhd/sys/dhd_linux.c
+++ b/bcm4329/src/dhd/sys/dhd_linux.c
@@ -1173,8 +1173,7 @@ dhd_watchdog(ulong data)
 
 	/* Reschedule the watchdog */
 #if defined(CONTINUOUS_WATCHDOG)
-	dhd->timer.expires = jiffies + dhd_watchdog_ms * HZ / 1000;
-	add_timer(&dhd->timer);
+	mod_timer(&dhd->timer, jiffies + dhd_watchdog_ms * HZ / 1000);
 #else
 	if (dhd->wd_timer_valid)
 		mod_timer(&dhd->timer, jiffies + dhd_watchdog_ms * HZ / 1000);
@@ -2278,15 +2277,8 @@ dhd_os_wd_timer(void *bus, uint wdtick)
 #endif /* !defined(CONTINUOUS_WATCHDOG) */
 
 #if defined(CONTINUOUS_WATCHDOG)
-	/* Stop timer and restart at new value */
-	if (dhd->wd_timer_valid == TRUE) {
-		del_timer_sync(&dhd->timer);
-		dhd->wd_timer_valid = FALSE;
-	}
-
 	dhd_watchdog_ms = (uint)wdtick;
-	dhd->timer.expires = jiffies + dhd_watchdog_ms * HZ / 1000;
-	add_timer(&dhd->timer);
+	mod_timer(&dhd->timer, jiffies + dhd_watchdog_ms * HZ / 1000);
 
 	dhd->wd_timer_valid = TRUE;
 #else
@@ -2300,21 +2292,9 @@ dhd_os_wd_timer(void *bus, uint wdtick)
 
 	if (wdtick) {
 		dhd_watchdog_ms = (uint)wdtick;
-		if (save_dhd_watchdog_ms != dhd_watchdog_ms){
-
-			if (dhd->wd_timer_valid == TRUE)
-				/* Stop timer and restart at new value */
-				del_timer_sync(&dhd->timer);
-
-			/* Create timer again when watchdog period is
-			   dynamically changed or in the first instance
-			*/
-			dhd->timer.expires = jiffies + dhd_watchdog_ms * HZ / 1000;
-			add_timer(&dhd->timer);
-		}else {
-			/* Re arm the timer, at last watchdog period */
-			mod_timer(&dhd->timer, jiffies + dhd_watchdog_ms * HZ / 1000);
-		}
+
+		/* Re arm the timer, at last watchdog period */
+		mod_timer(&dhd->timer, jiffies + dhd_watchdog_ms * HZ / 1000);
 
 		dhd->wd_timer_valid = TRUE;
 		save_dhd_watchdog_ms = wdtick;
diff --git a/bcm4329/src/wl/sys/wl_iw.c b/bcm4329/src/wl/sys/wl_iw.c
index 5628d89..9f3cebf 100644
--- a/bcm4329/src/wl/sys/wl_iw.c
+++ b/bcm4329/src/wl/sys/wl_iw.c
@@ -216,7 +216,7 @@ wl_iw_get_scan_prep(
 	wl_scan_results_t *list,
 	struct iw_request_info *info,
 	char *extra,
-	__u16 max_size
+	short max_size
 );
 
 
@@ -2307,7 +2307,7 @@ wl_iw_get_scan_prep(
 	wl_scan_results_t *list,
 	struct iw_request_info *info,
 	char *extra,
-	__u16 max_size)
+	short max_size)
 {
 	int  i, j;
 	struct iw_event  iwe;
@@ -2582,10 +2582,11 @@ wl_iw_iscan_get_scan(
 	while (p_buf != iscan->list_cur) {
 	    list = &((wl_iscan_results_t*)p_buf->iscan_buf)->results;
 
-	counter += list->count;
+	    counter += list->count;
 
 	    if (list->version != WL_BSS_INFO_VERSION) {
 		WL_ERROR(("list->version %d != WL_BSS_INFO_VERSION\n", list->version));
+		return -EINVAL; /* if WL_BSS_INFO_VERSION is corrupted iscan results are garbage */
 	    }
 
 	    bi = NULL;