[regression] iwlwifi: crash in iwl_parse_tlv_firmware()

[regression] iwlwifi: crash in iwl_parse_tlv_firmware()

[Kalle Valo]

Hi,

updated the kernel on my test laptop and noticed that now iwlwifi
crashes every time during boot. This is with tag ath-201701271935
ath.git master branch, which essentially is wt-2017-01-27 from
wireless-testing plus latest ath patches.

I tried v4.10-rc5 and iwlwifi didn't crash so my guess is that this is a
regression in the latest iwlwifi pull. Below is the crash log and the
location in source. This is all I got via netconsole.

[   39.296218] Intel(R) Wireless WiFi driver for Linux
[   39.296219] Copyright(c) 2003- 2015 Intel Corporation
[   39.299373] iwlwifi 0000:44:00.0: can't disable ASPM; OS doesn't have ASPM control
[   39.677192] BUG: unable to handle kernel NULL pointer dereference at 0000000c
[   39.677212] IP: iwl_parse_tlv_firmware.isra.5+0x9a0/0xd60 [iwlwifi]
[   39.677213] *pdpt = 000000002f5bd001 *pde = 0000000000000000 
[   39.677215] 
[   39.677217] Oops: 0002 [#1] SMP
[   39.677219] Modules linked in: btrtl(+) snd_seq_midi_event btbcm rfcomm(+) iwlwifi snd_rawmidi btintel bnep joydev input_leds coretemp cfg80211 bluetooth snd_seq snd_timer serio_raw snd_seq_device wmi snd video mac_hid soundcore lpc_ich shpchp parport_pc ppdev lp parport psmouse firewire_ohc
[   39.677244] CPU: 3 PID: 35 Comm: kworker/3:1 Not tainted 4.10.0-rc5-wt-ath+ #173
[   39.677245] Hardware name: Hewlett-Packard HP ProBook 6540b/1722, BIOS 68CDD Ver. F.04 01/27/2010
[   39.677252] Workqueue: events request_firmware_work_func
[   39.677254] task: f387bac0 task.stack: f3916000
[   39.677263] EIP: iwl_parse_tlv_firmware.isra.5+0x9a0/0xd60 [iwlwifi]
[   39.677264] EFLAGS: 00010293 CPU: 3
[   39.677266] EAX: 00000000 EBX: 0001ec18 ECX: f8fc2060 EDX: 000339f8
[   39.677267] ESI: f8fc2058 EDI: f8fe0c78 EBP: f3917e54 ESP: f3917df8
[   39.677268]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[   39.677270] CR0: 80050033 CR2: 0000000c CR3: 3033cd20 CR4: 000006f0
[   39.677271] Call Trace:

gdb drivers/net/wireless/intel/iwlwifi/iwlwifi.ko
(gdb) l *(iwl_parse_tlv_firmware+0x9a0)
0x2170 is in iwl_parse_tlv_firmware (drivers/net/wireless/intel/iwlwifi/iwl-drv.c:299).
294     static void set_sec_data(struct iwl_firmware_pieces *pieces,
295                              enum iwl_ucode_type type,
296                              int sec,
297                              const void *data)
298     {
299             pieces->img[type].sec[sec].data = data;
300     }
301
302     static void set_sec_size(struct iwl_firmware_pieces *pieces,
303                              enum iwl_ucode_type type,
(gdb) 

-- 
Kalle Valo

Re: [regression] iwlwifi: crash in iwl_parse_tlv_firmware()

[Kalle Valo]

Kalle Valo <kvalo@codeaurora.org> writes:

> updated the kernel on my test laptop and noticed that now iwlwifi
> crashes every time during boot. This is with tag ath-201701271935
> ath.git master branch, which essentially is wt-2017-01-27 from
> wireless-testing plus latest ath patches.
>
> I tried v4.10-rc5 and iwlwifi didn't crash so my guess is that this is a
> regression in the latest iwlwifi pull. Below is the crash log and the
> location in source. This is all I got via netconsole.

Forgot to include info about the device (from a working kernel):

[   17.911087] iwlwifi 0000:44:00.0: can't disable ASPM; OS doesn't have ASPM control
[   17.931205] iwlwifi 0000:44:00.0: loaded firmware version 39.31.5.1 build 35138 op_mode iwldvm
[   18.073590] iwlwifi 0000:44:00.0: CONFIG_IWLWIFI_DEBUG enabled
[   18.073679] iwlwifi 0000:44:00.0: CONFIG_IWLWIFI_DEBUGFS enabled
[   18.073757] iwlwifi 0000:44:00.0: CONFIG_IWLWIFI_DEVICE_TRACING enabled
[   18.073837] iwlwifi 0000:44:00.0: Detected Intel(R) Centrino(R) Wireless-N 1000 BGN, REV=0x6C
[   18.078383] iwlwifi 0000:44:00.0: L1 Enabled - LTR Disabled
[   19.359378] iwlwifi 0000:44:00.0 wlan1: renamed from wlan0

-- 
Kalle Valo

[PATCH] iwlwifi: alloc memory dynamically also for DVM

[Luca Coelho]

From: Sara Sharon <sara.sharon@intel.com>

For old firmwares the memory wasn't allocated, resulting in panic.
Make it dynamically allocated as well. Allow any order of functions
call.

Fixes: eef187a7b8a1 ("iwlwifi: enlarge number of ucode sections")
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---

Kalle,

Could you test this patch to see if it solves the problem?

Thanks!


drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 1d1af4bc1530..d22821501676 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -291,11 +291,33 @@ static struct fw_sec *get_sec(struct iwl_firmware_pieces *pieces,
 	return &pieces->img[type].sec[sec];
 }
 
+static void alloc_sec_data(struct iwl_firmware_pieces *pieces,
+			   enum iwl_ucode_type type,
+			   int sec)
+{
+	struct fw_img_parsing *img = &pieces->img[type];
+	struct fw_sec *sec_memory;
+	int size = sec + 1;
+	size_t alloc_size = sizeof(*img->sec) * size;
+
+	if (img->sec && img->sec_counter >= size)
+		return;
+
+	sec_memory = krealloc(img->sec, alloc_size, GFP_KERNEL);
+	if (!sec_memory)
+		return;
+
+	img->sec = sec_memory;
+	img->sec_counter = size;
+}
+
 static void set_sec_data(struct iwl_firmware_pieces *pieces,
 			 enum iwl_ucode_type type,
 			 int sec,
 			 const void *data)
 {
+	alloc_sec_data(pieces, type, sec);
+
 	pieces->img[type].sec[sec].data = data;
 }
 
@@ -304,6 +326,8 @@ static void set_sec_size(struct iwl_firmware_pieces *pieces,
 			 int sec,
 			 size_t size)
 {
+	alloc_sec_data(pieces, type, sec);
+
 	pieces->img[type].sec[sec].size = size;
 }
 
@@ -319,6 +343,8 @@ static void set_sec_offset(struct iwl_firmware_pieces *pieces,
 			   int sec,
 			   u32 offset)
 {
+	alloc_sec_data(pieces, type, sec);
+
 	pieces->img[type].sec[sec].offset = offset;
 }
 
-- 
2.11.0

Re: [PATCH] iwlwifi: alloc memory dynamically also for DVM

[Kalle Valo]

Luca Coelho <luca@coelho.fi> writes:

> From: Sara Sharon <sara.sharon@intel.com>
>
> For old firmwares the memory wasn't allocated, resulting in panic.
> Make it dynamically allocated as well. Allow any order of functions
> call.
>
> Fixes: eef187a7b8a1 ("iwlwifi: enlarge number of ucode sections")
> Signed-off-by: Sara Sharon <sara.sharon@intel.com>
> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
> ---
>
> Kalle,
>
> Could you test this patch to see if it solves the problem?

It does, thank you for quickly fixing this.

Tested-by: Kalle Valo <kvalo@codeaurora.org>

As this is a serious regression can I apply this directly to
wireless-drivers-next?

-- 
Kalle Valo

Re: [PATCH] iwlwifi: alloc memory dynamically also for DVM

[Luca Coelho]

On Mon, 2017-01-30 at 13:40 +0200, Kalle Valo wrote:
> Luca Coelho <luca@coelho.fi> writes:
> 
> > From: Sara Sharon <sara.sharon@intel.com>
> > 
> > For old firmwares the memory wasn't allocated, resulting in panic.
> > Make it dynamically allocated as well. Allow any order of functions
> > call.
> > 
> > Fixes: eef187a7b8a1 ("iwlwifi: enlarge number of ucode sections")
> > Signed-off-by: Sara Sharon <sara.sharon@intel.com>
> > Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
> > ---
> > 
> > Kalle,
> > 
> > Could you test this patch to see if it solves the problem?
> 
> It does, thank you for quickly fixing this.
> 
> Tested-by: Kalle Valo <kvalo@codeaurora.org>

Great! Thanks a lot for testing it quickly. :)


> As this is a serious regression can I apply this directly to
> wireless-drivers-next?

Yes, please go ahead.

--
Cheers,
Luca.

Re: iwlwifi: alloc memory dynamically also for DVM

[Kalle Valo]

Luciano Coelho <luca@coelho.fi> wrote:
> From: Sara Sharon <sara.sharon@intel.com>
> 
> For old firmwares the memory wasn't allocated, resulting in panic.
> Make it dynamically allocated as well. Allow any order of functions
> call.
> 
> Fixes: eef187a7b8a1 ("iwlwifi: enlarge number of ucode sections")
> Signed-off-by: Sara Sharon <sara.sharon@intel.com>
> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
> Tested-by: Kalle Valo <kvalo@codeaurora.org>

Patch applied to wireless-drivers-next.git, thanks.

d546530e5694 iwlwifi: alloc memory dynamically also for DVM

-- 
https://patchwork.kernel.org/patch/9544763/

Documentation about submitting wireless patches and checking status
from patchwork:

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches