wireless-drivers fixes for v5.6

Second set of fixes for v5.6. Only two small fixes this time.
 
 iwlwifi
 
 * fix another initialisation regression with 3168 devices
 
 mt76
 
 * fix memory corruption with too many rx fragments
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJeYQGUAAoJEG4XJFUm622bJPoIAJ9lKMQWzHP7s/PouMw4qa3l
 KyQHl0uZe6clEULYFi89vaUUzjmTZqsBkQXsKM+0cppxx1IxukLFtQw8UqgEWbpB
 eSDajpB5tvt7gSvLjGLyXtxZzj7Bn5T0IdgcPLxg9lmp0EwW/ycbX/XTCDqZSSq0
 IHkYKjRBoIhJ+JTZVYGPIk3GDwSb3PTVeT9C239Rj6Jhwou0p1vlopOjAsIr3dv9
 PIf/+21wHTtAgVejxKSQV4qUrNT2/J27gXht3hLwkm8goQV01z/3z03bQhEpfvm5
 CJr0hZAjLIR1T5RvYCqb41nhTFznlmrBYsozy1EtpMJGfGbNQ2XvRGZCU964lnk=
 =5YYp
 -----END PGP SIGNATURE-----

Merge tag 'wireless-drivers-2020-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers

Kalle Valo says:

====================
wireless-drivers fixes for v5.6

Second set of fixes for v5.6. Only two small fixes this time.

iwlwifi

* fix another initialisation regression with 3168 devices

mt76

* fix memory corruption with too many rx fragments
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/net/wireless/intel/iwlwifi/mvm/nvm.c

@@ -308,7 +308,8 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
 		}
 
 		/* PHY_SKU section is mandatory in B0 */
-		if (!mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) {
+		if (mvm->trans->cfg->nvm_type == IWL_NVM_EXT &&
+		    !mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) {
 			IWL_ERR(mvm,
 				"Can't parse phy_sku in B0, empty sections\n");
 			return NULL;

drivers/net/wireless/mediatek/mt76/dma.c

@@ -447,10 +447,13 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
 	struct page *page = virt_to_head_page(data);
 	int offset = data - page_address(page);
 	struct sk_buff *skb = q->rx_head;
+	struct skb_shared_info *shinfo = skb_shinfo(skb);
 
-	offset += q->buf_offset;
-	skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, offset, len,
-			q->buf_size);
+	if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
+		offset += q->buf_offset;
+		skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
+				q->buf_size);
+	}
 
 	if (more)
 		return;