From patchwork Wed Mar 30 14:04:35 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Emmanuel Grumbach X-Patchwork-Id: 8696591 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 9BCE8C0553 for ; Wed, 30 Mar 2016 14:05:45 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id C6C7620386 for ; Wed, 30 Mar 2016 14:05:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id DC62A2037F for ; Wed, 30 Mar 2016 14:05:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753536AbcC3OFm (ORCPT ); Wed, 30 Mar 2016 10:05:42 -0400 Received: from mga14.intel.com ([192.55.52.115]:59098 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752165AbcC3OFl (ORCPT ); Wed, 30 Mar 2016 10:05:41 -0400 Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga103.fm.intel.com with ESMTP; 30 Mar 2016 07:05:20 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.24,416,1455004800"; d="scan'208";a="678001662" Received: from egrumbacbox.jer.intel.com ([10.12.124.189]) by FMSMGA003.fm.intel.com with ESMTP; 30 Mar 2016 07:05:19 -0700 From: Emmanuel Grumbach To: linux-wireless@vger.kernel.org Cc: Matti Gottlieb , Emmanuel Grumbach Subject: [PATCH 03/43] iwlwifi: mvm: make sure FW contains the right amount of paging sections Date: Wed, 30 Mar 2016 17:04:35 +0300 Message-Id: <1459346715-7954-3-git-send-email-emmanuel.grumbach@intel.com> X-Mailer: git-send-email 2.5.0 In-Reply-To: <1459346667.4731.9.camel@intel.com> References: <1459346667.4731.9.camel@intel.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-7.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Matti Gottlieb Paging contains 3 sections in the fw. The first for the paging separator, The second for the CSS block, the third with the paging data. Currently if the driver finds the paging separator, and there is only section left (CSS), once reading the CSS section, the driver will attempt to read the paging data and will go out of the arrays bounds. Make sure that the FW image contains the right amount of sections for paging. Signed-off-by: Matti Gottlieb Signed-off-by: Emmanuel Grumbach --- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c index ebbadcf..766c262 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c @@ -174,8 +174,12 @@ static int iwl_fill_paging_mem(struct iwl_mvm *mvm, const struct fw_img *image) } } - if (sec_idx >= IWL_UCODE_SECTION_MAX) { - IWL_ERR(mvm, "driver didn't find paging image\n"); + /* + * If paging is enabled there should be at least 2 more sections left + * (one for CSS and one for Paging data) + */ + if (sec_idx >= ARRAY_SIZE(image->sec) - 1) { + IWL_ERR(mvm, "Paging: Missing CSS and/or paging sections\n"); iwl_free_fw_paging(mvm); return -EINVAL; }