From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Igor Grinberg" <grinberg@compulab.co.il>,
"Kalle Valo" <kvalo@codeaurora.org>,
"Uri Mashiach" <uri.mashiach@compulab.co.il>
Subject: [PATCH 3.2 13/87] wlcore/wl12xx: spi: fix oops on firmware load
Date: Mon, 08 Feb 2016 23:53:51 +0000 [thread overview]
Message-ID: <lsq.1454975631.154297201@decadent.org.uk> (raw)
In-Reply-To: <lsq.1454975630.125133756@decadent.org.uk>
3.2.77-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Uri Mashiach <uri.mashiach@compulab.co.il>
commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.
The maximum chunks used by the function is
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last
command is stored outside the bounds of the commands array.
Oops 5 (page fault) is generated during current wl1271 firmware load
attempt:
root@debian-armhf:~# ifconfig wlan0 up
[ 294.312399] Unable to handle kernel paging request at virtual address
00203fc4
[ 294.320173] pgd = de528000
[ 294.323028] [00203fc4] *pgd=00000000
[ 294.326916] Internal error: Oops: 5 [#1] SMP ARM
[ 294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
hwmon
[ 294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
4.2.0-00002-g3e9ad27-dirty #78
[ 294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
[ 294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
[ 294.372236] PC is at __spi_validate+0xa8/0x2ac
[ 294.376902] LR is at __spi_sync+0x78/0x210
[ 294.381200] pc : [<c049c760>] lr : [<c049ebe0>] psr: 60000013
[ 294.381200] sp : de551998 ip : de5519d8 fp : 00200000
[ 294.393242] r10: de551c8c r9 : de5519d8 r8 : de3a9000
[ 294.398730] r7 : de3a9258 r6 : de3a9400 r5 : de551a48 r4 :
00203fbc
[ 294.405577] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 :
de3a9000
[ 294.412420] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM
Segment user
[ 294.419918] Control: 10c5387d Table: 9e528019 DAC: 00000015
[ 294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
[ 294.432437] Stack: (0xde551998 to 0xde552000)
...
[ 294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>]
(__spi_sync+0x78/0x210)
[ 294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>]
(wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
[ 294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from
[<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
[ 294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from
[<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx])
[ 294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>]
(wl1271_op_add_interface+0x5b0/0x910 [wlcore])
[ 294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from
[<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211])
[ 294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from
[<c0537978>] (__dev_open+0xa8/0x110)
[ 294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>]
(__dev_change_flags+0x88/0x148)
[ 294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>]
(dev_change_flags+0x18/0x48)
[ 294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>]
(devinet_ioctl+0x6b4/0x7d0)
[ 294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>]
(sock_ioctl+0x1e4/0x2bc)
[ 294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>]
(do_vfs_ioctl+0x420/0x6b0)
[ 294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>]
(SyS_ioctl+0x6c/0x7c)
[ 295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>]
(ret_fast_syscall+0x0/0x54)
[ 295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
[ 295.021544] ---[ end trace 66ed188198f4e24e ]---
Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/wireless/wl12xx/spi.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -67,7 +67,10 @@
/* HW limitation: maximum possible chunk size is 4095 bytes */
#define WSPI_MAX_CHUNK_SIZE 4092
-#define WSPI_MAX_NUM_OF_CHUNKS (WL1271_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE)
+/* Maximum number of SPI write chunks */
+#define WSPI_MAX_NUM_OF_CHUNKS \
+ ((WL1271_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1)
+
static inline struct spi_device *wl_to_spi(struct wl1271 *wl)
{
@@ -274,9 +277,10 @@ static void wl1271_spi_raw_read(struct w
static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
size_t len, bool fixed)
{
- struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)];
+ /* SPI write buffers - 2 for each chunk */
+ struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
struct spi_message m;
- u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
+ u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; /* 1 command per chunk */
u32 *cmd;
u32 chunk_len;
int i;
next prev parent reply other threads:[~2016-02-09 0:21 UTC|newest]
Thread overview: 91+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-08 23:53 [PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 79/87] crypto: af_alg - Forbid bind(2) when nokey child sockets are present Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 37/87] uml: fix hostfs mknod() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 31/87] x86/xen: don't reset vcpu_info on a cancelled suspend Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 02/87] [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 84/87] [media] usbvision-video: fix memory leak of alt_max_pkt_size Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 51/87] cifs: fix race between call_async() and reconnect() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 87/87] [media] usbvision: fix crash on detecting device with invalid configuration Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 04/87] SCSI: initio: remove duplicate module device table Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 65/87] IB/qib: fix mcast detach when qp not attached Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 14/87] EDAC: Robustify workqueues destruction Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 66/87] IB/mlx4: Initialize hop_limit when creating address handle Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 61/87] ALSA: hrtimer: Fix stall by hrtimer_cancel() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 82/87] crypto: algif_skcipher - Load TX SG list after waiting Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 07/87] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 12/87] wlcore: SPI - fix spi transfer_list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 27/87] rtlwifi: rtl8192ce: Fix handling of module parameters Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 46/87] x86/mm: Improve switch_mm() barrier comments Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 30/87] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 83/87] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 69/87] crypto: af_alg - Disallow bind/setkey/... after accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 53/87] m32r: fix m32104ut_defconfig build fail Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 08/87] mtd: nand: fix ONFI parameter page layout Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 33/87] udf: Check output buffer length when converting name to CS0 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 57/87] ALSA: timer: Harden slave timer list handling Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 43/87] ALSA: seq: Fix missing NULL check at remove_events ioctl Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 59/87] printk: help pr_debug and pr_devel to optimize out arguments Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 49/87] sparc64: fix incorrect sign extension in sys_sparc64_personality Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 44/87] ALSA: seq: Fix race at timer setup and close Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 54/87] dma-debug: switch check from _text to _stext Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 71/87] crypto: algif_skcipher - Add nokey compatibility path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 20/87] drm/radeon: clean up fujitsu quirks Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 03/87] [media] rc: allow rc modules to be loaded if rc-main is not a module Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 64/87] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 76/87] crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 73/87] crypto: algif_hash - Require setkey before accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 55/87] scripts/bloat-o-meter: fix python3 syntax error Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 70/87] crypto: af_alg - Add nokey compatibility path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 22/87] USB: cp210x: add ID for ELV Marble Sound Board 1 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 35/87] locks: fix unlock when fcntl_setlk races with a close Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 39/87] ipv6: tcp: add rcu locking in tcp_v6_send_synack() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 41/87] x86/boot: Double BOOT_HEAP_SIZE to 64KB Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 19/87] ALSA: fm801: propagate TUNER_ONLY bit when autodetected Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 23/87] posix-clock: Fix return code on the poll method's error path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 36/87] dm snapshot: fix hung bios when copy error occurs Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 62/87] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 85/87] [media] usbvision: fix leak of usb_dev on failure paths in usbvision_probe() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 50/87] cifs: Ratelimit kernel log messages Ben Hutchings
2016-02-08 23:53 ` Ben Hutchings [this message]
2016-02-08 23:53 ` [PATCH 3.2 52/87] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 32/87] udf: Prevent buffer overrun with multi-byte characters Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 17/87] asix: silence log message from oversize packet Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 26/87] rtlwifi: rtl8192se: Fix module parameter initialization Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 56/87] ocfs2/dlm: ignore cleaning the migration mle that is inuse Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 34/87] power: test_power: correctly handle empty writes Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 86/87] [media] usbvision fix overflow of interfaces array Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 16/87] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 74/87] crypto: skcipher - Add crypto_skcipher_has_setkey Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 81/87] crypto: algif_skcipher - Fix race condition in skcipher_check_key Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 67/87] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 58/87] memcg: only free spare array when readers are done Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 63/87] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 21/87] udf: limit the maximum number of indirect extents in a row Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 45/87] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 05/87] KVM: x86: expose MSR_TSC_AUX to userspace Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 25/87] rtlwifi: rtl8192de: Fix incorrect module parameter descriptions Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 09/87] drm/radeon: call hpd_irq_event on resume Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 11/87] rtlwifi: fix memory leak for USB device Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 80/87] crypto: algif_hash - Fix race condition in hash_check_key Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 29/87] NFS: Fix attribute cache revalidation Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 10/87] xhci: refuse loading if nousb is used Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 06/87] KVM: x86: correctly print #AC in traces Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 42/87] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 15/87] powerpc: Make value-returning atomics fully ordered Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 68/87] crypto: algif_skcipher - Require setkey before accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 75/87] crypto: algif_skcipher - Add key check exception for cipher_null Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 28/87] rtlwifi: rtl8192cu: Add missing parameter setup Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 01/87] [media] gspca: ov534/topro: prevent a division by 0 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 72/87] crypto: hash - Add crypto_ahash_has_setkey Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 48/87] ALSA: timer: Fix race among timer ioctls Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 78/87] crypto: algif_skcipher - Remove custom release parent function Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 60/87] crypto: af_alg - Fix socket double-free when accept fails Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 77/87] crypto: algif_hash - Remove custom release parent function Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 24/87] x86/LDT: Print the real LDT base address Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 18/87] futex: Drop refcount if requeue_pi() acquired the rtmutex Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 40/87] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 47/87] ALSA: timer: Fix double unlink of active_list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 38/87] uml: flush stdout before forking Ben Hutchings
2016-02-09 0:21 ` [PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings
2016-02-09 3:58 ` Guenter Roeck
2016-02-10 1:00 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1454975631.154297201@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=grinberg@compulab.co.il \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=uri.mashiach@compulab.co.il \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome