Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ba36c16 authored by Sara Sharon's avatar Sara Sharon Committed by Greg Kroah-Hartman
Browse files

iwlwifi: mvm: fix BAR seq ctrl reporting 



[ Upstream commit 941ab4eb66c10bc5c7234e83a7a858b2806ed151 ]

There is a bug in FW where the sequence control may be
incorrect, and the driver overrides it with the value
of the ieee80211 header.

However, in BAR there is no sequence control in the header,
which result with arbitrary sequence.

This access to an unknown location is bad and it makes the
logs very confusing - so fix it.

Signed-off-by: default avatarSara Sharon <sara.sharon@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 44e0f15b

drivers/net/wireless/intel/iwlwifi/mvm/tx.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -1405,6 +1405,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm, 
	while (!skb_queue_empty(&skbs)) {

	while (!skb_queue_empty(&skbs)) {

		struct sk_buff *skb = __skb_dequeue(&skbs);

		struct sk_buff *skb = __skb_dequeue(&skbs);

		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

		struct ieee80211_hdr *hdr = (void *)skb->data;

		bool flushed = false;

		bool flushed = false;





		skb_freed++;

		skb_freed++;
@@ -1449,11 +1450,11 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm, 
			info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;

			info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;

		info->flags &= ~IEEE80211_TX_CTL_AMPDU;

		info->flags &= ~IEEE80211_TX_CTL_AMPDU;





		/* W/A FW bug: seq_ctl is wrong when the status isn't success */

		/* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */

		if (status != TX_STATUS_SUCCESS) {

		if (ieee80211_is_back_req(hdr->frame_control))

			struct ieee80211_hdr *hdr = (void *)skb->data;

			seq_ctl = 0;

		else if (status != TX_STATUS_SUCCESS)

			seq_ctl = le16_to_cpu(hdr->seq_ctrl);

			seq_ctl = le16_to_cpu(hdr->seq_ctrl);

		}





		if (unlikely(!seq_ctl)) {

		if (unlikely(!seq_ctl)) {

			struct ieee80211_hdr *hdr = (void *)skb->data;

			struct ieee80211_hdr *hdr = (void *)skb->data;