mirror
/
linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
linux/drivers
History
Dmitry Safonov 01c195de62 brcmsmac: ampdu: Check BA window size before checking block ack 
bindex can be out of BA window (64):
  tid 0 seq 2983, start_seq 2915, bindex 68, index 39
  tid 0 seq 2984, start_seq 2915, bindex 69, index 40
  tid 0 seq 2985, start_seq 2915, bindex 70, index 41
  tid 0 seq 2986, start_seq 2915, bindex 71, index 42
  tid 0 seq 2879, start_seq 2915, bindex 4060, index 63
  tid 0 seq 2854, start_seq 2915, bindex 4035, index 38
  tid 0 seq 2795, start_seq 2915, bindex 3976, index 43
  tid 0 seq 2989, start_seq 2924, bindex 65, index 45
  tid 0 seq 2992, start_seq 2924, bindex 68, index 48
  tid 0 seq 2993, start_seq 2924, bindex 69, index 49
  tid 0 seq 2994, start_seq 2924, bindex 70, index 50
  tid 0 seq 2997, start_seq 2924, bindex 73, index 53
  tid 0 seq 2795, start_seq 2941, bindex 3950, index 43
  tid 0 seq 2921, start_seq 2941, bindex 4076, index 41
  tid 0 seq 2929, start_seq 2941, bindex 4084, index 49
  tid 0 seq 3011, start_seq 2946, bindex 65, index 3
  tid 0 seq 3012, start_seq 2946, bindex 66, index 4
  tid 0 seq 3013, start_seq 2946, bindex 67, index 5

In result isset() will try to dereference something on the stack,
causing panics:
  BUG: unable to handle page fault for address: ffffa742800ed01f
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 6a4e9067 P4D 6a4e9067 PUD 6a4ec067 PMD 6a4ed067 PTE 0
  Oops: 0000 [#1] PREEMPT SMP PTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Not tainted 5.8.5-arch1-1-kdump #1
  Hardware name: Apple Inc. MacBookAir3,1/Mac-942452F5819B1C1B, BIOS    MBA31.88Z.0061.B07.1201241641 01/24/12
  RIP: 0010:brcms_c_ampdu_dotxstatus+0x343/0x9f0 [brcmsmac]
  Code: 54 24 20 66 81 e2 ff 0f 41 83 e4 07 89 d1 0f b7 d2 66 c1 e9 03 0f b7 c9 4c 8d 5c 0c 48 49 8b 4d 10 48 8b 79 68 41 57 44 89 e1 <41> 0f b6 33 41 d3 e0 48 c7 c1 38 e0 ea c0 48 83 c7 10 44 21 c6 4c
  RSP: 0018:ffffa742800ecdd0 EFLAGS: 00010207
  RAX: 0000000000000019 RBX: 000000000000000b RCX: 0000000000000006
  RDX: 0000000000000ffe RSI: 0000000000000004 RDI: ffff8fc6ad776800
  RBP: ffff8fc6855acb00 R08: 0000000000000001 R09: 00000000000005d9
  R10: 00000000fffffffe R11: ffffa742800ed01f R12: 0000000000000006
  R13: ffff8fc68d75a000 R14: 00000000000005db R15: 0000000000000019
  FS:  0000000000000000(0000) GS:ffff8fc6aad00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffffa742800ed01f CR3: 000000002480a000 CR4: 00000000000406e0
  Call Trace:
   <IRQ>
   brcms_c_dpc+0xb46/0x1020 [brcmsmac]
   ? wlc_intstatus+0xc8/0x180 [brcmsmac]
   ? __raise_softirq_irqoff+0x1a/0x80
   brcms_dpc+0x37/0xd0 [brcmsmac]
   tasklet_action_common.constprop.0+0x51/0xb0
   __do_softirq+0xff/0x340
   ? handle_level_irq+0x1a0/0x1a0
   asm_call_on_stack+0x12/0x20
   </IRQ>
   do_softirq_own_stack+0x5f/0x80
   irq_exit_rcu+0xcb/0x120
   common_interrupt+0xd1/0x200
   asm_common_interrupt+0x1e/0x40
  RIP: 0010:cpuidle_enter_state+0xb3/0x420

Check if the block is within BA window and only then check block's
status. Otherwise as Behan wrote: "When I came back to Dublin I
was courtmartialed in my absence and sentenced to death in my absence,
so I said they could shoot me in my absence."

Also reported:
https://bbs.archlinux.org/viewtopic.php?id=258428
https://lore.kernel.org/linux-wireless/87tuwgi92n.fsf@yujinakao.com/

Reported-by: Yuji Nakao <contact@yujinakao.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201116030635.645811-1-dima@arista.com
 		2020-11-24 17:03:51 +02:00
..
accessibility
…
acpi More ACPI updates for 5.10-rc1 2020-10-23 16:38:36 -07:00
amba
…
android task_work: cleanup notification modes 2020-10-17 15:05:30 -06:00
ata Merge branch 'parisc-5.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux 2020-10-25 10:59:34 -07:00
atm
…
auxdisplay
…
base More power management updates for 5.10-rc1 2020-10-23 16:27:03 -07:00
bcma
…
block xen: branch for v5.10-rc1c 2020-10-25 10:55:35 -07:00
bluetooth networking changes for the 5.10 merge window 2020-10-15 18:42:13 -07:00
bus ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
cdrom
…
char random32: make prandom_u32() output unpredictable 2020-10-24 20:21:57 +02:00
clk treewide: Convert macro and uses of __section(foo) to __section("foo") 2020-10-25 14:51:49 -07:00
clocksource treewide: Convert macro and uses of __section(foo) to __section("foo") 2020-10-25 14:51:49 -07:00
connector
…
counter
…
cpufreq ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
cpuidle powerpc updates for 5.10 2020-10-16 12:21:15 -07:00
crypto s390 updates for the 5.10 merge window 2020-10-16 12:36:38 -07:00
dax fuse update for 5.10 2020-10-19 14:28:30 -07:00
dca
…
devfreq
…
dio
…
dma ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
dma-buf dma-mapping updates for 5.10 2020-10-15 14:43:29 -07:00
edac EFI changes for v5.10: 2020-10-12 13:26:49 -07:00
eisa
…
extcon
…
firewire
…
firmware ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
fpga
…
fsi
…
gnss
…
gpio - New Drivers 2020-10-14 15:56:58 -07:00
gpu ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
greybus
…
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2020-10-23 16:16:31 -07:00
hsi
…
hv Merge branch 'akpm' (patches from Andrew) 2020-10-16 11:31:55 -07:00
hwmon ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
hwspinlock
…
hwtracing intel_th: pci: Add Alder Lake CPU support 2020-10-05 12:43:54 +02:00
i2c i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs 2020-10-25 13:33:54 +01:00
i3c * Fix DAA for the pre-reserved address case 2020-10-17 11:01:01 -07:00
ide block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
idle intel_idle: Ignore _CST if control cannot be taken from the platform 2020-10-16 17:28:32 +02:00
iio chrome platform changes for 5.10 2020-10-23 10:54:13 -07:00
infiniband RDMA 5.10 pull request 2020-10-17 11:18:18 -07:00
input Merge branch 'parisc-5.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux 2020-10-25 10:59:34 -07:00
interconnect
…
iommu IOMMU Fix for Linux v5.10: 2020-10-20 09:35:06 -07:00
ipack
…
irqchip treewide: Convert macro and uses of __section(foo) to __section("foo") 2020-10-25 14:51:49 -07:00
isdn
…
leds leds: pwm: Remove platform_data support 2020-10-07 12:02:58 +02:00
lightnvm lightnvm: fix out-of-bounds write to array devices->info[] 2020-10-16 09:28:45 -06:00
macintosh powerpc updates for 5.10 2020-10-16 12:21:15 -07:00
mailbox ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
mcb
…
md - Improve DM core's bio splitting to use blk_max_size_offset(). Also 2020-10-14 15:05:38 -07:00
media dma-mapping updates for 5.10 2020-10-15 14:43:29 -07:00
memory ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
memstick
…
message SCSI misc on 20201013 2020-10-14 15:15:35 -07:00
mfd - New Drivers 2020-10-14 15:56:58 -07:00
misc pci-v5.10-changes 2020-10-22 12:41:00 -07:00
mmc ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
most
…
mtd This pull request contains fixes for UBI and UBIFS 2020-10-18 09:56:50 -07:00
mux
…
net brcmsmac: ampdu: Check BA window size before checking block ack 2020-11-24 17:03:51 +02:00
nfc nfc: remove unneeded break 2020-10-20 10:36:41 -07:00
ntb Bug fixes for v5.10 2020-10-25 11:12:31 -07:00
nubus
…
nvdimm mm/memremap_pages: support multiple ranges per invocation 2020-10-13 18:38:28 -07:00
nvme nvme-fc: shorten reconnect delay if possible for FC 2020-10-23 12:54:45 +02:00
nvmem
…
of treewide: Convert macro and uses of __section(foo) to __section("foo") 2020-10-25 14:51:49 -07:00
opp Merge branch 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm 2020-10-06 12:26:45 +02:00
oprofile
…
parisc dma-mapping: split <linux/dma-mapping.h> 2020-10-06 07:07:03 +02:00
parport
…
pci VFIO updates for v5.10-rc1 2020-10-22 13:00:44 -07:00
pcmcia
…
perf
…
phy pci-v5.10-changes 2020-10-22 12:41:00 -07:00
pinctrl Pin control bulk changes for the v5.10 kernel cycle 2020-10-14 15:25:04 -07:00
platform Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2020-10-23 16:16:31 -07:00
pnp PNP: remove the now unused pnp_find_card() function 2020-10-08 18:00:08 +02:00
power ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
powercap powercap: Fix typo in Kconfig "Plance" -> "Plane" 2020-10-19 17:40:53 +02:00
pps
…
ps3
…
ptp
…
pwm ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2020-10-16 11:11:22 -07:00
ras
…
regulator Merge remote-tracking branch 'regulator/for-5.10' into regulator-next 2020-10-05 16:54:56 +01:00
remoteproc remoteproc updates for v5.10 2020-10-22 12:56:33 -07:00
reset ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
rpmsg rpmsg updates for 5.10 2020-10-22 12:58:21 -07:00
rtc RTC for 5.10 2020-10-21 11:22:08 -07:00
s390 s390 updates for the 5.10 merge window 2020-10-16 12:36:38 -07:00
sbus
…
scsi block-5.10-2020-10-24 2020-10-24 12:46:42 -07:00
sfi
…
sh
…
siox
…
slimbus
…
soc ARM: Devicetree updates 2020-10-24 10:44:18 -07:00
soundwire
…
spi ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
spmi
…
ssb
…
staging mm: remove kzfree() compatibility definition 2020-10-25 11:39:02 -07:00
target SCSI misc on 20201023 2020-10-23 16:19:02 -07:00
tc
…
tee
…
thermal treewide: Convert macro and uses of __section(foo) to __section("foo") 2020-10-25 14:51:49 -07:00
thunderbolt
…
tty ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
uio
…
usb ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
vdpa vhost,vdpa,virtio: cleanups, fixes 2020-10-23 11:00:57 -07:00
vfio VFIO updates for v5.10-rc1 2020-10-22 13:00:44 -07:00
vhost vhost_vdpa: remove unnecessary spin_lock in vhost_vring_call 2020-10-21 10:48:10 -04:00
video ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
virt
…
virtio vhost,vdpa,virtio: cleanups, fixes 2020-10-23 11:00:57 -07:00
visorbus
…
vlynq
…
vme
…
w1 w1: w1_therm: make w1_poll_completion static 2020-10-05 14:49:24 +02:00
watchdog ARM: SoC platform updates 2020-10-24 10:33:08 -07:00
xen xen: branch for v5.10-rc1c 2020-10-25 10:55:35 -07:00
zorro
…
Kconfig
…
Makefile
…