Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e25d65f2 authored by Sara Sharon's avatar Sara Sharon Committed by Luca Coelho
Browse files

iwlwifi: pcie: don't use vid 0 



In cases of hardware or DMA error, the vid read from
a zeroed location will be 0, and we will access the rxb
at index 0 in the global table, while it may be NULL or
owned by hardware.
Invalidate vid 0 in order to detect the situation and
bail out.

Signed-off-by: default avatarSara Sharon <sara.sharon@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 3edbc7da

drivers/net/wireless/intel/iwlwifi/pcie/rx.c

+7 −4
Original line number Diff line number Diff line
@@ -960,7 +960,7 @@ int iwl_pcie_rx_init(struct iwl_trans *trans) 
		else

			list_add(&rxb->list, &def_rxq->rx_used);

		trans_pcie->global_table[i] = rxb;

		rxb->vid = (u16)i;

		rxb->vid = (u16)(i + 1);

	}



	iwl_pcie_rxq_alloc_rbs(trans, GFP_KERNEL, def_rxq);
@@ -1249,10 +1249,13 @@ static void iwl_pcie_rx_handle(struct iwl_trans *trans, int queue) 
			 */

			u16 vid = le32_to_cpu(rxq->used_bd[i]) & 0x0FFF;



			if (WARN(vid >= ARRAY_SIZE(trans_pcie->global_table),

				 "Invalid rxb index from HW %u\n", (u32)vid))

			if (WARN(!vid ||

				 vid > ARRAY_SIZE(trans_pcie->global_table),

				 "Invalid rxb index from HW %u\n", (u32)vid)) {

				iwl_force_nmi(trans);

				goto out;

			rxb = trans_pcie->global_table[vid];

			}

			rxb = trans_pcie->global_table[vid - 1];

		} else {

			rxb = rxq->queue[i];

			rxq->queue[i] = NULL;