Commit 40dc7154 authored by Sara Sharon's avatar Sara Sharon Committed by Greg Kroah-Hartman

iwlwifi: pcie: fix access to scratch buffer

commit d5d0689a upstream.

This fixes a pretty ancient bug that hasn't manifested itself
until now.
The scratchbuf for command queue is allocated only for 32 slots
but is accessed with the queue write pointer - which can be
up to 256.
Since the scratch buf size was 16 and there are up to 256 TFDs
we never passed a page boundary when accessing the scratch buffer,
but when attempting to increase the size of the scratch buffer a
panic was quick to follow when trying to access the address resulted
in a page boundary.
Signed-off-by: default avatarSara Sharon <sara.sharon@intel.com>
Fixes: 38c0f334 ("iwlwifi: use coherent DMA memory for command header")
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0d5b1752
...@@ -1508,9 +1508,9 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans, ...@@ -1508,9 +1508,9 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
/* start the TFD with the scratchbuf */ /* start the TFD with the scratchbuf */
scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE); scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size); memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
iwl_pcie_txq_build_tfd(trans, txq, iwl_pcie_txq_build_tfd(trans, txq,
iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr), iwl_pcie_get_scratchbuf_dma(txq, idx),
scratch_size, true); scratch_size, true);
/* map first command fragment, if any remains */ /* map first command fragment, if any remains */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment