diff options
| author | Dong Aisheng <b29396@freescale.com> | 2013-12-12 19:02:49 +0800 |
|---|---|---|
| committer | Dong Aisheng <b29396@freescale.com> | 2013-12-16 10:46:54 +0800 |
| commit | 533751d6177c63ca28081036644406a03f2ce55b (patch) | |
| tree | f3472ec565168ceed394a2edb50a81ece584a3ae | |
| parent | 37604b8c400a22adce6448803418432c21d84bf1 (diff) | |
ENGR00292033 wireless: ath6kl: fix potiential firmware dump issue
When run iperf we could see the following error:
root@freescale ~$ iperf -c 192.168.0.102 -i 5 -t 60
------------------------------------------------------------
Client connecting to 192.168.0.100, TCP port 5001
TCP window size: 20.7 KByte (default)
------------------------------------------------------------
[ 3] local 192.168.0.102 port 38093 connected with 192.168.0.100 port 5001
ath6kl: firmware crashed
ath6kl: crash dump:
ath6kl: hw 0x30000582 fw 3.2.0.144^A
ath6kl: 0: 0x30000582 0x000015b3 0x008ee731 0x004f5b31
ath6kl: 4: 0x008ee731 0x00060730 0x0000001e 0x00544248
ath6kl: 8: 0x0056526c 0x005652ac 0x00568fa8 0x00568fa8
ath6kl: 12: 0x00000009 0xffffffff 0x00917d19 0x00917d3b
ath6kl: 16: 0x00917ca7 0x008e1038 0x00000000 0x00000000
ath6kl: 20: 0x408ee731 0x005441b8 0x00000001 0x004f5a00
ath6kl: 24: 0x808ee8c6 0x00544218 0x00571880 0xc08ee731
ath6kl: 28: 0x808efa6a 0x00544248 0x0056526c 0x00000004
ath6kl: 32: 0x808e2756 0x00544278 0x00565780 0x00000000
ath6kl: 36: 0x808e166c 0x005442a8 0x00000004 0x00542810
ath6kl: 40: 0x808e1640 0x005442d8 0x00540000 0x00000000
ath6kl: 44: 0x808e16bd 0x005442f8 0x00540d14 0x00000000
ath6kl: 48: 0x408e0c24 0x00544318 0x00519291 0x000017a8
ath6kl: 52: 0x00000000 0x00544338 0x00559301 0x00040020
ath6kl: 56: 0x00565780 0x0f000000 0xf0000000 0x00000001
There's actually a major bug right there, scat_list can corrupt scat_q_depth.
Move scat_list down after scat_q_depth and change to scat_q_depth[0] to
avoid the possible corruption of scat_q_depth.
Signed-off-by: Dong Aisheng <b29396@freescale.com>
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/hif.h | 4 | ||||
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/sdio.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/hif.h b/drivers/net/wireless/ath/ath6kl/hif.h index 61f6b21fb0ae..dc6bd8cd9b83 100644 --- a/drivers/net/wireless/ath/ath6kl/hif.h +++ b/drivers/net/wireless/ath/ath6kl/hif.h @@ -197,9 +197,9 @@ struct hif_scatter_req { /* bounce buffer for upper layers to copy to/from */ u8 *virt_dma_buf; - struct hif_scatter_item scat_list[1]; - u32 scat_q_depth; + + struct hif_scatter_item scat_list[0]; }; struct ath6kl_irq_proc_registers { diff --git a/drivers/net/wireless/ath/ath6kl/sdio.c b/drivers/net/wireless/ath/ath6kl/sdio.c index 8f971b4fafe4..4c0510a32354 100644 --- a/drivers/net/wireless/ath/ath6kl/sdio.c +++ b/drivers/net/wireless/ath/ath6kl/sdio.c @@ -349,7 +349,7 @@ static int ath6kl_sdio_alloc_prep_scat_req(struct ath6kl_sdio *ar_sdio, int i, scat_req_sz, scat_list_sz, sg_sz, buf_sz; u8 *virt_buf; - scat_list_sz = (n_scat_entry - 1) * sizeof(struct hif_scatter_item); + scat_list_sz = n_scat_entry * sizeof(struct hif_scatter_item); scat_req_sz = sizeof(*s_req) + scat_list_sz; if (!virt_scat) |