1 files changed, 37 insertions, 6 deletions

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index ebc12c521fe0..55c823f983c7 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -802,6 +802,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
 {
         struct ath10k_peer *peer, *tmp;
         int peer_id;
+        int i;
 
         lockdep_assert_held(&ar->conf_mutex);
 
@@ -818,6 +819,17 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
                         ar->peer_map[peer_id] = NULL;
                 }
 
+                /* Double check that peer is properly un-referenced from
+                 * the peer_map
+                 */
+                for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
+                        if (ar->peer_map[i] == peer) {
+                                ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %p idx %d)\n",
+                                            peer->addr, peer, i);
+                                ar->peer_map[i] = NULL;
+                        }
+                }
+
                 list_del(&peer->list);
                 kfree(peer);
                 ar->num_peers--;
@@ -828,6 +840,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
 static void ath10k_peer_cleanup_all(struct ath10k *ar)
 {
         struct ath10k_peer *peer, *tmp;
+        int i;
 
         lockdep_assert_held(&ar->conf_mutex);
 
@@ -836,6 +849,10 @@ static void ath10k_peer_cleanup_all(struct ath10k *ar)
                 list_del(&peer->list);
                 kfree(peer);
         }
+
+        for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++)
+                ar->peer_map[i] = NULL;
+
         spin_unlock_bh(&ar->data_lock);
 
         ar->num_peers = 0;
@@ -2939,7 +2956,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                         if (channel->flags & IEEE80211_CHAN_DISABLED)
                                 continue;
 
-                        ch->allow_ht   = true;
+                        ch->allow_ht = true;
 
                         /* FIXME: when should we really allow VHT? */
                         ch->allow_vht = true;
@@ -3675,17 +3692,18 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
 
 static void ath10k_mac_txq_init(struct ieee80211_txq *txq)
 {
-        struct ath10k_txq *artxq = (void *)txq->drv_priv;
+        struct ath10k_txq *artxq;
 
         if (!txq)
                 return;
 
+        artxq = (void *)txq->drv_priv;
         INIT_LIST_HEAD(&artxq->list);
 }
 
 static void ath10k_mac_txq_unref(struct ath10k *ar, struct ieee80211_txq *txq)
 {
-        struct ath10k_txq *artxq = (void *)txq->drv_priv;
+        struct ath10k_txq *artxq;
         struct ath10k_skb_cb *cb;
         struct sk_buff *msdu;
         int msdu_id;
@@ -3693,6 +3711,7 @@ static void ath10k_mac_txq_unref(struct ath10k *ar, struct ieee80211_txq *txq)
         if (!txq)
                 return;
 
+        artxq = (void *)txq->drv_priv;
         spin_lock_bh(&ar->txqs_lock);
         if (!list_empty(&artxq->list))
                 list_del_init(&artxq->list);
@@ -4228,6 +4247,9 @@ static struct ieee80211_sta_vht_cap ath10k_create_vht_cap(struct ath10k *ar)
                         mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
         }
 
+        if (ar->cfg_tx_chainmask <= 1)
+                vht_cap.cap &= ~IEEE80211_VHT_CAP_TXSTBC;
+
         vht_cap.vht_mcs.rx_mcs_map = cpu_to_le16(mcs_map);
         vht_cap.vht_mcs.tx_mcs_map = cpu_to_le16(mcs_map);
 
@@ -4265,7 +4287,7 @@ static struct ieee80211_sta_ht_cap ath10k_get_ht_cap(struct ath10k *ar)
                 ht_cap.cap |= smps;
         }
 
-        if (ar->ht_cap_info & WMI_HT_CAP_TX_STBC)
+        if (ar->ht_cap_info & WMI_HT_CAP_TX_STBC && (ar->cfg_tx_chainmask > 1))
                 ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
 
         if (ar->ht_cap_info & WMI_HT_CAP_RX_STBC) {
@@ -5979,9 +6001,17 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                                 continue;
 
                         if (peer->sta == sta) {
-                                ath10k_warn(ar, "found sta peer %pM entry on vdev %i after it was supposedly removed\n",
-                                            sta->addr, arvif->vdev_id);
+                                ath10k_warn(ar, "found sta peer %pM (ptr %p id %d) entry on vdev %i after it was supposedly removed\n",
+                                            sta->addr, peer, i, arvif->vdev_id);
                                 peer->sta = NULL;
+
+                                /* Clean up the peer object as well since we
+                                 * must have failed to do this above.
+                                 */
+                                list_del(&peer->list);
+                                ar->peer_map[i] = NULL;
+                                kfree(peer);
+                                ar->num_peers--;
                         }
                 }
                 spin_unlock_bh(&ar->data_lock);
@@ -7406,6 +7436,7 @@ static const struct ieee80211_ops ath10k_ops = {
 #endif
 #ifdef CONFIG_MAC80211_DEBUGFS
         .sta_add_debugfs                = ath10k_sta_add_debugfs,
+        .sta_statistics                 = ath10k_sta_statistics,
 #endif
 };