From patchwork Sun May 6 09:33:21 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tee Hao Wei X-Patchwork-Id: 10382693 X-Patchwork-Delegate: luca@coelho.fi Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A2D6F60353 for ; Sun, 6 May 2018 09:33:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9D15528BE1 for ; Sun, 6 May 2018 09:33:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8FA1828BF6; Sun, 6 May 2018 09:33:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0916428BE1 for ; Sun, 6 May 2018 09:33:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751273AbeEFJd1 (ORCPT ); Sun, 6 May 2018 05:33:27 -0400 Received: from mail-pg0-f68.google.com ([74.125.83.68]:34816 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751091AbeEFJd0 (ORCPT ); Sun, 6 May 2018 05:33:26 -0400 Received: by mail-pg0-f68.google.com with SMTP id j11-v6so18230087pgf.2 for ; Sun, 06 May 2018 02:33:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=in04.sg; s=google; h=subject:from:to:references:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=vPjmaBgoX+j/hhiXW1daJqTIPMMPhzkS/vAOHvoYB5I=; b=Y1GEAQW2J38+p6I8rtdGXB8Qfw2WT6lGyBC+gpwxgGhsHBUS/KPpXDENT/MunGTWaU N6/6qQwwOsqzOqYpoiNO9DqbvyCAVsnpcv9WCIUd439EJBfmpy6aswG03A06jpw814tW 9S6WxFcsBuf1YrEV15Laf9v2vOB+ugZ/Z8qJ+xKROcAOaVcR2b1YJcx+s8VMA42XImC5 92sbbRQeNVnzGf5nCltrSRdgxGzD+OoFcrJor7O2dCyDz+/SV2VXgr8XoLgAvv6w4dv9 RKyiXpoO1wt5mMUJG2grTehxLr/f9gIgEa3kbtAvZkq6YCfecHlAOTH7NjKw9F0QHD/X BWtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:references:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=vPjmaBgoX+j/hhiXW1daJqTIPMMPhzkS/vAOHvoYB5I=; b=cstMPitHR4hZk2jPofaBBK3QJ3x3X4Mmdrv/rJNsLprn2Lce9qu5UjjGUi9XNjs+Nc hGkigWDadcyRKXGRdop5yok8Cx2FM6Bi6WMdUnb79HhIVSCEYIg0QwTmpPutiBMfDR5w HVLSXr/cW+twNxUjXJkakeedQPUmhtS5vxPh+CkJdr6CbwuShgN4jN/oQ+HyeasCCRUZ 2Ed192CucvimOvu8BcBhoz0fh9iFCn5vBKkYJnhVxZHun0ijMAxHa5c57QDQNljeL+bT u5JuLZ8ALAhNlHU3rbSdSDJXd+ARjgHW2cqQH+y6ku41PcFJmnY+7NV7n+5X+eyLZQbH LbBg== X-Gm-Message-State: ALQs6tB/Dm97zVi+0mKNovx+/fn7PmMSRx3trLXdTeKsQpMGU3xwRWvr xJ1cRSWTGqppN4+42mX1d0y3hHhlqOWN1Q== X-Google-Smtp-Source: AB8JxZqzWrTNuyZyTZHMkiNPWNqkxk+FYpPVMPJrJhqvHZpM6BRvj4hrMWhSoiu1sODAf3FxS6uCBA== X-Received: by 2002:a17:902:265:: with SMTP id 92-v6mr33121253plc.368.1525599205571; Sun, 06 May 2018 02:33:25 -0700 (PDT) Received: from ?IPv6:2406:3003:2000:1e23:e2d5:5eff:fe6e:2982? ([2406:3003:2000:1e23:e2d5:5eff:fe6e:2982]) by smtp.gmail.com with ESMTPSA id t68-v6sm31386475pgc.62.2018.05.06.02.33.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 06 May 2018 02:33:24 -0700 (PDT) Subject: [PATCH v3] iwlwifi: compare with actual number of IRQs requested for, not number of CPUs From: Hao Wei Tee To: johannes.berg@intel.com, emmanuel.grumbach@intel.com, luciano.coelho@intel.com, linuxwifi@intel.com, linux-wireless@vger.kernel.org References: <0b07aa06-111b-4399-786d-056d9bba5cdd@in04.sg> Message-ID: Date: Sun, 6 May 2018 17:33:21 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: <0b07aa06-111b-4399-786d-056d9bba5cdd@in04.sg> Content-Language: en-US Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When there are 16 or more logical CPUs, we request for `IWL_MAX_RX_HW_QUEUES` (16) IRQs only as we limit to that number of IRQs, but later on we compare the number of IRQs returned to nr_online_cpus+2 instead of max_irqs, the latter being what we actually asked for. This ends up setting num_rx_queues to 17 which causes lots of out-of-bounds array accesses later on. Compare to max_irqs instead, and also add an assertion in case num_rx_queues > IWM_MAX_RX_HW_QUEUES. Signed-off-by: Hao Wei Tee --- I think this is a better fix than what I sent previously. But you guys are probably looking into it now, so please disregard my probably-incorrect fix. Thanks. drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c index 6e9a9ecfb11c..aa469046f86c 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c @@ -1633,16 +1633,17 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev, * Two interrupts less: non rx causes shared with FBQ and RSS. * More than two interrupts: we will use fewer RSS queues. */ - if (num_irqs <= nr_online_cpus) { + if (num_irqs <= max_irqs - 2) { trans_pcie->trans->num_rx_queues = num_irqs + 1; trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX | IWL_SHARED_IRQ_FIRST_RSS; - } else if (num_irqs == nr_online_cpus + 1) { + } else if (num_irqs == max_irqs - 1) { trans_pcie->trans->num_rx_queues = num_irqs; trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX; } else { trans_pcie->trans->num_rx_queues = num_irqs - 1; } + WARN_ON(trans_pcie->trans->num_rx_queues > IWL_MAX_RX_HW_QUEUES); trans_pcie->alloc_vecs = num_irqs; trans_pcie->msix_enabled = true;