niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

brcmsmac: fix bounds checking in tx/rx

Browse source 
brcms_b_txstatus and brcms_b_recv are off by one when
doing bounds checking on number of packets to process

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Piotr Haber <phaber@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Piotr Haber 2012-11-28 21:44:07 +01:00 • committed by John W. Linville
parent 94d9902dc0
commit 57fe504817
1 changed files with 17 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
drivers/net/wireless/brcm80211/brcmsmac/main.c
View file

@ -1044,11 +1044,17 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
s1 = bcma_read32(core, D11REGOFFS(frmtxstatus)); s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
while (!(*fatal) while (!(*fatal)
&& (s1 & TXS_V)) { && (s1 & TXS_V)) {
/* !give others some time to run! */
if (n >= max_tx_num) {
morepending = true;
break;
}
if (s1 == 0xffffffff) { if (s1 == 0xffffffff) {
brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit, brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
__func__); __func__);
return morepending; *fatal = true;
return false;
} }
s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2)); s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
@ -1060,17 +1066,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
*fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs); *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
/* !give others some time to run! */
if (++n >= max_tx_num)
break;
s1 = bcma_read32(core, D11REGOFFS(frmtxstatus)); s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
n++;
} }
if (*fatal) if (*fatal)
return 0; return false;
if (n >= max_tx_num)
morepending = true;
return morepending; return morepending;
} }
@ -7631,16 +7632,19 @@ brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
uint n = 0; uint n = 0;
uint bound_limit = bound ? RXBND : -1; uint bound_limit = bound ? RXBND : -1;
bool morepending;
skb_queue_head_init(&recv_frames); skb_queue_head_init(&recv_frames);
/* gather received frames */ /* gather received frames */
while (dma_rx(wlc_hw->di[fifo], &recv_frames)) { do {
/* !give others some time to run! */ /* !give others some time to run! */
if (++n >= bound_limit) if (n >= bound_limit)
break; break;
}
morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
n++;
} while (morepending);
/* post more rbufs */ /* post more rbufs */
dma_rxfill(wlc_hw->di[fifo]); dma_rxfill(wlc_hw->di[fifo]);
@ -7670,7 +7674,7 @@ brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
brcms_c_recv(wlc_hw->wlc, p); brcms_c_recv(wlc_hw->wlc, p);
} }
return n >= bound_limit; return morepending;
} }
/* second-level interrupt processing /* second-level interrupt processing