Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1329788

[PATCH 3.2 13/87] wlcore/wl12xx: spi: fix oops on firmware load

Show all headers | View raw

3.2.77-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Uri Mashiach <uri.mashiach@compulab.co.il>

commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.

The maximum chunks used by the function is
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last
command is stored outside the bounds of the commands array.

Oops 5 (page fault) is generated during current wl1271 firmware load
attempt:

root@debian-armhf:~# ifconfig wlan0 up
[  294.312399] Unable to handle kernel paging request at virtual address
00203fc4
[  294.320173] pgd = de528000
[  294.323028] [00203fc4] *pgd=00000000
[  294.326916] Internal error: Oops: 5 [#1] SMP ARM
[  294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
hwmon
[  294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
4.2.0-00002-g3e9ad27-dirty #78
[  294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
[  294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
[  294.372236] PC is at __spi_validate+0xa8/0x2ac
[  294.376902] LR is at __spi_sync+0x78/0x210
[  294.381200] pc : [<c049c760>]    lr : [<c049ebe0>]    psr: 60000013
[  294.381200] sp : de551998  ip : de5519d8  fp : 00200000
[  294.393242] r10: de551c8c  r9 : de5519d8  r8 : de3a9000
[  294.398730] r7 : de3a9258  r6 : de3a9400  r5 : de551a48  r4 :
00203fbc
[  294.405577] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 :
de3a9000
[  294.412420] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment user
[  294.419918] Control: 10c5387d  Table: 9e528019  DAC: 00000015
[  294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
[  294.432437] Stack: (0xde551998 to 0xde552000)

...

[  294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>]
(__spi_sync+0x78/0x210)
[  294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>]
(wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
[  294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from
[<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
[  294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from
[<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx])
[  294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>]
(wl1271_op_add_interface+0x5b0/0x910 [wlcore])
[  294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from
[<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211])
[  294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from
[<c0537978>] (__dev_open+0xa8/0x110)
[  294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>]
(__dev_change_flags+0x88/0x148)
[  294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>]
(dev_change_flags+0x18/0x48)
[  294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>]
(devinet_ioctl+0x6b4/0x7d0)
[  294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>]
(sock_ioctl+0x1e4/0x2bc)
[  294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>]
(do_vfs_ioctl+0x420/0x6b0)
[  294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>]
(SyS_ioctl+0x6c/0x7c)
[  295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>]
(ret_fast_syscall+0x0/0x54)
[  295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
[  295.021544] ---[ end trace 66ed188198f4e24e ]---

Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/net/wireless/wl12xx/spi.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -67,7 +67,10 @@
 /* HW limitation: maximum possible chunk size is 4095 bytes */
 #define WSPI_MAX_CHUNK_SIZE    4092
 
-#define WSPI_MAX_NUM_OF_CHUNKS (WL1271_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE)
+/* Maximum number of SPI write chunks */
+#define WSPI_MAX_NUM_OF_CHUNKS \
+	((WL1271_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1)
+
 
 static inline struct spi_device *wl_to_spi(struct wl1271 *wl)
 {
@@ -274,9 +277,10 @@ static void wl1271_spi_raw_read(struct w
 static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
 			  size_t len, bool fixed)
 {
-	struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)];
+	/* SPI write buffers - 2 for each chunk */
+	struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
 	struct spi_message m;
-	u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
+	u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; /* 1 command per chunk */
 	u32 *cmd;
 	u32 chunk_len;
 	int i;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 79/87] crypto: af_alg - Forbid bind(2) when nokey  child sockets are present Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 17/87] asix: silence log message from oversize packet Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 73/87] crypto: algif_hash - Require setkey before  accept(2) Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 18/87] futex: Drop refcount if requeue_pi() acquired  the rtmutex Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 60/87] crypto: af_alg - Fix socket double-free when  accept fails Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 72/87] crypto: hash - Add crypto_ahash_has_setkey Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 70/87] crypto: af_alg - Add nokey compatibility path Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 57/87] ALSA: timer: Harden slave timer list handling Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 61/87] ALSA: hrtimer: Fix stall by hrtimer_cancel() Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 82/87] crypto: algif_skcipher - Load TX SG list after  waiting Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 11/87] rtlwifi: fix memory leak for USB device Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 64/87] ALSA: control: Avoid kernel warnings from tlv  ioctl with numid 0 Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 01/87] [media] gspca: ov534/topro: prevent a division by 0 Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 08/87] mtd: nand: fix ONFI parameter page layout Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 80/87] crypto: algif_hash - Fix race condition in  hash_check_key Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 04/87] SCSI: initio: remove duplicate module device table Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 87/87] [media] usbvision: fix crash on detecting  device with invalid configuration Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 15/87] powerpc: Make value-returning atomics fully ordered Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 10/87] xhci: refuse loading if nousb is used Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 05/87] KVM: x86: expose MSR_TSC_AUX to userspace Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 86/87] [media] usbvision fix overflow of interfaces array Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 85/87] [media] usbvision: fix leak of usb_dev on  failure paths in  usbvision_probe() Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 07/87] ath9k_htc: check for underflow in  ath9k_htc_rx_msg() Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 13/87] wlcore/wl12xx: spi: fix oops on firmware load Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 14/87] EDAC: Robustify workqueues destruction Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 19/87] ALSA: fm801: propagate TUNER_ONLY bit when  autodetected Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 84/87] [media] usbvision-video: fix memory leak of  alt_max_pkt_size Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 12/87] wlcore: SPI - fix spi transfer_list Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 16/87] powerpc: Make {cmp}xchg* and their atomic_  versions fully ordered Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 78/87] crypto: algif_skcipher - Remove custom release  parent function Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 03/87] [media] rc: allow rc modules to be loaded if  rc-main is not a module Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  Re: [PATCH 3.2 00/87] 3.2.77-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-02-09 05:00 +0100
    Re: [PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-02-10 02:10 +0100

csiph-web