Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 94543a8d authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville
Browse files

iwlwifi: fix flow handler debug code 



iwl_dbgfs_fh_reg_read() can cause crashes and/or
BUG_ON in slub because the ifdefs are wrong, the
code in iwl_dump_fh() should use DEBUGFS, not
DEBUG to protect the buffer writing code.

Also, while at it, clean up the arguments to the
function, some code and make it generally safer.

Cc: stable@vger.kernel.org
Reported-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 7b4e6cfb

drivers/net/wireless/iwlwifi/pcie/internal.h

+1 −1
Original line number Diff line number Diff line
@@ -350,7 +350,7 @@ int iwl_queue_space(const struct iwl_queue *q); 
/*****************************************************

* Error handling

******************************************************/

int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display);

int iwl_dump_fh(struct iwl_trans *trans, char **buf);

void iwl_dump_csr(struct iwl_trans *trans);



/*****************************************************

drivers/net/wireless/iwlwifi/pcie/rx.c

+1 −1
Original line number Diff line number Diff line
@@ -555,7 +555,7 @@ static void iwl_irq_handle_error(struct iwl_trans *trans) 
	}



	iwl_dump_csr(trans);

	iwl_dump_fh(trans, NULL, false);

	iwl_dump_fh(trans, NULL);



	iwl_op_mode_nic_error(trans->op_mode);

}

drivers/net/wireless/iwlwifi/pcie/trans.c

+16 −14
Original line number Diff line number Diff line
@@ -1649,13 +1649,9 @@ static const char *get_fh_string(int cmd) 
#undef IWL_CMD

}



int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)

int iwl_dump_fh(struct iwl_trans *trans, char **buf)

{

	int i;

#ifdef CONFIG_IWLWIFI_DEBUG

	int pos = 0;

	size_t bufsz = 0;

#endif

	static const u32 fh_tbl[] = {

		FH_RSCSR_CHNL0_STTS_WPTR_REG,

		FH_RSCSR_CHNL0_RBDCB_BASE_REG,
@@ -1667,29 +1663,35 @@ int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display) 
		FH_TSSR_TX_STATUS_REG,

		FH_TSSR_TX_ERROR_REG

	};

#ifdef CONFIG_IWLWIFI_DEBUG

	if (display) {

		bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;



#ifdef CONFIG_IWLWIFI_DEBUGFS

	if (buf) {

		int pos = 0;

		size_t bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;



		*buf = kmalloc(bufsz, GFP_KERNEL);

		if (!*buf)

			return -ENOMEM;



		pos += scnprintf(*buf + pos, bufsz - pos,

				"FH register values:\n");

		for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {



		for (i = 0; i < ARRAY_SIZE(fh_tbl); i++)

			pos += scnprintf(*buf + pos, bufsz - pos,

				"  %34s: 0X%08x\n",

				get_fh_string(fh_tbl[i]),

				iwl_read_direct32(trans, fh_tbl[i]));

		}



		return pos;

	}

#endif



	IWL_ERR(trans, "FH register values:\n");

	for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {

	for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++)

		IWL_ERR(trans, "  %34s: 0X%08x\n",

			get_fh_string(fh_tbl[i]),

			iwl_read_direct32(trans, fh_tbl[i]));

	}



	return 0;

}
@@ -1982,11 +1984,11 @@ static ssize_t iwl_dbgfs_fh_reg_read(struct file *file, 
				     size_t count, loff_t *ppos)

{

	struct iwl_trans *trans = file->private_data;

	char *buf;

	char *buf = NULL;

	int pos = 0;

	ssize_t ret = -EFAULT;



	ret = pos = iwl_dump_fh(trans, &buf, true);

	ret = pos = iwl_dump_fh(trans, &buf);

	if (buf) {

		ret = simple_read_from_buffer(user_buf,

					      count, ppos, buf, pos);