diff options
| author | Sara Sharon <sara.sharon@intel.com> | 2016-06-09 17:19:35 +0300 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2016-07-06 09:40:33 +0300 |
| commit | d5d0689aefc59c6a5352ca25d7e6d47d03f543ce (patch) | |
| tree | 184846293e4c60361b7ac278db44665957ee8a9b /drivers/net/wireless/intel/iwlwifi/pcie | |
| parent | 54f315cb082bf98290575e858d1e0274bb0eebe0 (diff) | |
| download | linux-d5d0689aefc59c6a5352ca25d7e6d47d03f543ce.tar.xz | |
iwlwifi: pcie: fix access to scratch buffer
This fixes a pretty ancient bug that hasn't manifested itself
until now.
The scratchbuf for command queue is allocated only for 32 slots
but is accessed with the queue write pointer - which can be
up to 256.
Since the scratch buf size was 16 and there are up to 256 TFDs
we never passed a page boundary when accessing the scratch buffer,
but when attempting to increase the size of the scratch buffer a
panic was quick to follow when trying to access the address resulted
in a page boundary.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Fixes: 38c0f334b359 ("iwlwifi: use coherent DMA memory for command header")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/pcie')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c index 8901d49aebd5..9b5858bc8ee2 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c @@ -1604,9 +1604,9 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans, /* start the TFD with the scratchbuf */ scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE); - memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size); + memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size); iwl_pcie_txq_build_tfd(trans, txq, - iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr), + iwl_pcie_get_scratchbuf_dma(txq, idx), scratch_size, true); /* map first command fragment, if any remains */ |