* Patch "iwlwifi: pcie: fix access to scratch buffer" has been added to the 4.7-stable tree
@ 2016-10-04 16:22 gregkh
0 siblings, 0 replies; only message in thread
From: gregkh @ 2016-10-04 16:22 UTC (permalink / raw)
To: sara.sharon, gregkh, luciano.coelho; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
iwlwifi: pcie: fix access to scratch buffer
to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
iwlwifi-pcie-fix-access-to-scratch-buffer.patch
and it can be found in the queue-4.7 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From d5d0689aefc59c6a5352ca25d7e6d47d03f543ce Mon Sep 17 00:00:00 2001
From: Sara Sharon <sara.sharon@intel.com>
Date: Thu, 9 Jun 2016 17:19:35 +0300
Subject: iwlwifi: pcie: fix access to scratch buffer
From: Sara Sharon <sara.sharon@intel.com>
commit d5d0689aefc59c6a5352ca25d7e6d47d03f543ce upstream.
This fixes a pretty ancient bug that hasn't manifested itself
until now.
The scratchbuf for command queue is allocated only for 32 slots
but is accessed with the queue write pointer - which can be
up to 256.
Since the scratch buf size was 16 and there are up to 256 TFDs
we never passed a page boundary when accessing the scratch buffer,
but when attempting to increase the size of the scratch buffer a
panic was quick to follow when trying to access the address resulted
in a page boundary.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Fixes: 38c0f334b359 ("iwlwifi: use coherent DMA memory for command header")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -1595,9 +1595,9 @@ static int iwl_pcie_enqueue_hcmd(struct
/* start the TFD with the scratchbuf */
scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
- memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
+ memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
iwl_pcie_txq_build_tfd(trans, txq,
- iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
+ iwl_pcie_get_scratchbuf_dma(txq, idx),
scratch_size, true);
/* map first command fragment, if any remains */
Patches currently in stable-queue which might be from sara.sharon@intel.com are
queue-4.7/iwlwifi-pcie-fix-access-to-scratch-buffer.patch
queue-4.7/iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch
queue-4.7/iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2016-10-04 16:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-10-04 16:22 Patch "iwlwifi: pcie: fix access to scratch buffer" has been added to the 4.7-stable tree gregkh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.