diff options
| author | Sara Sharon <sara.sharon@intel.com> | 2016-06-09 17:19:35 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2016-11-20 01:16:46 +0000 |
| commit | 87759467c0478188cb8f8d08329129f5fb87dc21 (patch) | |
| tree | 3274a189f9559a37c1cfcfadc92a366bafda8596 /include/linux/timerqueue.h | |
| parent | 24b38673b286a615a86836f9c19423a43a404982 (diff) | |
iwlwifi: pcie: fix access to scratch buffer
commit d5d0689aefc59c6a5352ca25d7e6d47d03f543ce upstream.
This fixes a pretty ancient bug that hasn't manifested itself
until now.
The scratchbuf for command queue is allocated only for 32 slots
but is accessed with the queue write pointer - which can be
up to 256.
Since the scratch buf size was 16 and there are up to 256 TFDs
we never passed a page boundary when accessing the scratch buffer,
but when attempting to increase the size of the scratch buffer a
panic was quick to follow when trying to access the address resulted
in a page boundary.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Fixes: 38c0f334b359 ("iwlwifi: use coherent DMA memory for command header")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include/linux/timerqueue.h')
0 files changed, 0 insertions, 0 deletions