releases/4.19.34/iwlwifi-mvm-fix-rfh-config-command-with-10-cpus.patch

   1 From 388a86df563dad2578e725fe15d34ad00173b98a Mon Sep 17 00:00:00 2001
   2 From: Johannes Berg <johannes.berg@intel.com>
   3 Date: Tue, 11 Dec 2018 21:20:43 +0100
   4 Subject: iwlwifi: mvm: fix RFH config command with >=10 CPUs
   5
   6 [ Upstream commit dbf592f3d14fb7d532cb7c820b1065cf33e02aaa ]
   7
   8 If we have >=10 (logical) CPUs, our command size exceeds the
   9 internal buffer size and the command fails; fix that by using
  10 IWL_HCMD_DFL_NOCOPY for the command that's allocated anyway.
  11
  12 While at it, also fix the leak of cmd, and use struct_size()
  13 to calculate its size.
  14
  15 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  16 Fixes: 8edbfaa19835 ("iwlwifi: mvm: configure multi RX queue")
  17 Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
  18 Signed-off-by: Sasha Levin <sashal@kernel.org>
  19 ---
  20  drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 20 ++++++++++++++------
  21  1 file changed, 14 insertions(+), 6 deletions(-)
  22
  23 diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
  24 index 16c6c7f921a8..8b7d70e3a379 100644
  25 --- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
  26 +++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
  27 @@ -132,13 +132,17 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
  28
  29  static int iwl_configure_rxq(struct iwl_mvm *mvm)
  30  {
  31 -       int i, num_queues, size;
  32 +       int i, num_queues, size, ret;
  33         struct iwl_rfh_queue_config *cmd;
  34 +       struct iwl_host_cmd hcmd = {
  35 +               .id = WIDE_ID(DATA_PATH_GROUP, RFH_QUEUE_CONFIG_CMD),
  36 +               .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
  37 +       };
  38
  39         /* Do not configure default queue, it is configured via context info */
  40         num_queues = mvm->trans->num_rx_queues - 1;
  41
  42 -       size = sizeof(*cmd) + num_queues * sizeof(struct iwl_rfh_queue_data);
  43 +       size = struct_size(cmd, data, num_queues);
  44
  45         cmd = kzalloc(size, GFP_KERNEL);
  46         if (!cmd)
  47 @@ -159,10 +163,14 @@ static int iwl_configure_rxq(struct iwl_mvm *mvm)
  48                 cmd->data[i].fr_bd_wid = cpu_to_le32(data.fr_bd_wid);
  49         }
  50
  51 -       return iwl_mvm_send_cmd_pdu(mvm,
  52 -                                   WIDE_ID(DATA_PATH_GROUP,
  53 -                                           RFH_QUEUE_CONFIG_CMD),
  54 -                                   0, size, cmd);
  55 +       hcmd.data[0] = cmd;
  56 +       hcmd.len[0] = size;
  57 +
  58 +       ret = iwl_mvm_send_cmd(mvm, &hcmd);
  59 +
  60 +       kfree(cmd);
  61 +
  62 +       return ret;
  63  }
  64
  65  static int iwl_mvm_send_dqa_cmd(struct iwl_mvm *mvm)
  66 --
  67 2.19.1
  68