| Message ID | 20211119054512.10620-2-pkshih@realtek.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 5737b4515deea0829c138ab5201160345ec67d49 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | rtw89: fix crash when loading firmware file on certain platforms | expand |
Ping-Ke Shih <pkshih@realtek.com> wrote: > The partition size is used to tell hardware the size of piece we are going > to send a firmware. The old code updates the size in constant buffer of > firmware, and leads system crash. > > To fix this, update the size on skb->data after we copy the firmware data > into skb. > > Buglink: https://bugzilla.opensuse.org/show_bug.cgi?id=1188303 > Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") > Reported-by: Takashi Iwai <tiwai@suse.de> > Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> > Tested-by: Takashi Iwai <tiwai@suse.de> > Tested-by: Larry Finger <Larry.Finger@lwfinger.net> Patch applied to wireless-drivers.git, thanks. 5737b4515dee rtw89: update partition size of firmware header on skb->data
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 212aaf577d3c5..65ef3dc9d0614 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -91,7 +91,6 @@ static int rtw89_fw_hdr_parser(struct rtw89_dev *rtwdev, const u8 *fw, u32 len, info->section_num = GET_FW_HDR_SEC_NUM(fw); info->hdr_len = RTW89_FW_HDR_SIZE + info->section_num * RTW89_FW_SECTION_HDR_SIZE; - SET_FW_HDR_PART_SIZE(fw, FWDL_SECTION_PER_PKT_LEN); bin = fw + info->hdr_len; @@ -275,6 +274,7 @@ static int __rtw89_fw_download_hdr(struct rtw89_dev *rtwdev, const u8 *fw, u32 l } skb_put_data(skb, fw, len); + SET_FW_HDR_PART_SIZE(skb->data, FWDL_SECTION_PER_PKT_LEN); rtw89_h2c_pkt_set_hdr_fwdl(rtwdev, skb, FWCMD_TYPE_H2C, H2C_CAT_MAC, H2C_CL_MAC_FWDL, H2C_FUNC_MAC_FWHDR_DL, len); diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h index 7ee0d93233107..36e8d0da6c1e7 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.h +++ b/drivers/net/wireless/realtek/rtw89/fw.h @@ -282,8 +282,10 @@ struct rtw89_h2creg_sch_tx_en { le32_get_bits(*((__le32 *)(fwhdr) + 6), GENMASK(15, 8)) #define GET_FW_HDR_CMD_VERSERION(fwhdr) \ le32_get_bits(*((__le32 *)(fwhdr) + 7), GENMASK(31, 24)) -#define SET_FW_HDR_PART_SIZE(fwhdr, val) \ - le32p_replace_bits((__le32 *)(fwhdr) + 7, val, GENMASK(15, 0)) +static inline void SET_FW_HDR_PART_SIZE(void *fwhdr, u32 val) +{ + le32p_replace_bits((__le32 *)fwhdr + 7, val, GENMASK(15, 0)); +} #define SET_CTRL_INFO_MACID(table, val) \ le32p_replace_bits((__le32 *)(table) + 0, val, GENMASK(6, 0))
The partition size is used to tell hardware the size of piece we are going to send a firmware. The old code updates the size in constant buffer of firmware, and leads system crash. To fix this, update the size on skb->data after we copy the firmware data into skb. Buglink: https://bugzilla.opensuse.org/show_bug.cgi?id=1188303 Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") Reported-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Tested-by: Takashi Iwai <tiwai@suse.de> Tested-by: Larry Finger <Larry.Finger@lwfinger.net> --- drivers/net/wireless/realtek/rtw89/fw.c | 2 +- drivers/net/wireless/realtek/rtw89/fw.h | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-)