• Michal Kazior's avatar
    ath10k: prevent using invalid ringbuffer indexes · 432358ed
    Michal Kazior authored
    If the device is removed and hotplug fails
    ioread32() will return 0xFFFFFFFF. In that case
    reading ringbuffer during device bringup led to
    out-of-bounds addressing of a ringbuffer array
    that in turn led to a paging failure.
    
    This could be reproduced by the following:
     * boot without acpi/prevent hotplug from working
     * insert and manually detect (pci rescan) the device
     * remove the device physically
     * load ath10k driver
     * kernel crashed
    
    Ringbuffer index reading is now protected by using
    an appropriate mask to prevent addressing an
    invalid array index.
    Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
    Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
    432358ed
ce.c 33.1 KB