Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b4410c7d authored by Johannes Berg's avatar Johannes Berg Committed by Greg Kroah-Hartman
Browse files

iwlwifi: mvm: fix RFH config command with >=10 CPUs 



[ Upstream commit dbf592f3d14fb7d532cb7c820b1065cf33e02aaa ]

If we have >=10 (logical) CPUs, our command size exceeds the
internal buffer size and the command fails; fix that by using
IWL_HCMD_DFL_NOCOPY for the command that's allocated anyway.

While at it, also fix the leak of cmd, and use struct_size()
to calculate its size.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Fixes: 8edbfaa1 ("iwlwifi: mvm: configure multi RX queue")
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 080e00c8

drivers/net/wireless/intel/iwlwifi/mvm/fw.c

+14 −6
Original line number Diff line number Diff line
@@ -132,13 +132,17 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm) 


static int iwl_configure_rxq(struct iwl_mvm *mvm)

{

	int i, num_queues, size;

	int i, num_queues, size, ret;

	struct iwl_rfh_queue_config *cmd;

	struct iwl_host_cmd hcmd = {

		.id = WIDE_ID(DATA_PATH_GROUP, RFH_QUEUE_CONFIG_CMD),

		.dataflags[0] = IWL_HCMD_DFL_NOCOPY,

	};



	/* Do not configure default queue, it is configured via context info */

	num_queues = mvm->trans->num_rx_queues - 1;



	size = sizeof(*cmd) + num_queues * sizeof(struct iwl_rfh_queue_data);

	size = struct_size(cmd, data, num_queues);



	cmd = kzalloc(size, GFP_KERNEL);

	if (!cmd)
@@ -159,10 +163,14 @@ static int iwl_configure_rxq(struct iwl_mvm *mvm) 
		cmd->data[i].fr_bd_wid = cpu_to_le32(data.fr_bd_wid);

	}



	return iwl_mvm_send_cmd_pdu(mvm,

				    WIDE_ID(DATA_PATH_GROUP,

					    RFH_QUEUE_CONFIG_CMD),

				    0, size, cmd);

	hcmd.data[0] = cmd;

	hcmd.len[0] = size;



	ret = iwl_mvm_send_cmd(mvm, &hcmd);



	kfree(cmd);



	return ret;

}



static int iwl_mvm_send_dqa_cmd(struct iwl_mvm *mvm)